With a userbase of 21 million users, GoDaddy is one of the major players when it comes to providing web hosting services. Given this popularity, GoDaddy’s servers are used by major organizations all over the world such as news outlets, bloggers and e-commerce brands to deliver content and services. And this means there’s a lot of data on the GoDaddy servers, data which is both confidential and valuable. Therefore, to a threat actor, it provides an irresistible target.
Due to the GoDaddy breach, and the business world’s reliance on websites, it’s crucial we understand the mechanics of this stealthy threat.
What Happened to GoDaddy?
The GoDaddy breach first came to its owner’s attentions in December 2022, but it soon became apparent this breach was related to similar breaches in November 2021 and October 2019. However, far from being isolated incidents, these attacks were all part of the same campaign and remained hidden within the IT infrastructure of GoDaddy.
The most recent attack, in December 2022, found the cPanel hosting servers used by GoDaddy customers compromised by threat actors. This gave the attackers full access to the settings involved in how the customers’ websites work and direct traffic. As a result of this breach, visitors to the affected websites were intermittently redirected to malicious websites. Although there is no evidence that it occurred, unauthorized access to the cPanel would also give the threat actors the opportunity to disable access to a website.
What if Your Website is Hosted by GoDaddy?
Given that the initial attacks on GoDaddy’s servers compromised login credentials and secure SSL keys for websites, the latest attack is highly embarrassing for GoDaddy. After all, which organization would want to align themselves with a web host whose servers had regularly been hacked? Nonetheless, GoDaddy has sought to reassure customers that their infrastructure is now secure and security has been enhanced.
Naturally, customers using GoDaddy’s services are going to remain wary, so it’s important they:
- Monitor network activity: one of the hallmarks of the GoDaddy hack involves the redirection of traffic from the target website to malicious websites. Therefore, it’s vital you monitor the internet traffic hitting your site and analyze whether it’s reaching the intended pages or being redirected elsewhere. If you detect something unusual, it’s best to start digging deeper and get in touch with GoDaddy’s support team.
- Change your password: if you’re a GoDaddy customer, it’s recommended you change your password. In fact, regardless of which web hosting service you use, it’s important that you regularly change your password to avoid falling victim to stolen login credentials.
- Assess your website: due to the access which the GoDaddy breach gave the threat actors, it makes sense to go through your website and ensure nothing is amiss. For example, are your links still directing traffic to where they should be? And are there any unusual popups prompting visitors to “click here”? It may take time to complete a full sweep of your website, but it will be worth it to protect your brand and your customers.
For more ways to secure and optimize your business technology, contact your local IT professionals.
Read More