Data Breach Spreads To Six Web Hosts

Wordpress

By Taylor Davis Last updated Nov 24, 2021

0

Share

The GoDaddy data breach that affected up to 1.2 million web hosts has expanded to six more web hosts serving customers worldwide. The six additional compromised web hosts are resellers of GoDaddy’s hosting services. The extent of the intrusion appears to be the same as with GoDaddy, with matching dates of when the security intrusion began.

The six compromised web hosting providers are:

• 123Reg
• Domain Factory
• Heart Internet
• Host Europe
• Media Temple
• tsoHost

Advertisement

Continue Reading Below

Precise Dates of Intrusion

The state of California published notification of a security breach submitted by GoDaddy on November 23, 2021.

In the California notification GoDaddy provided specific dates for the security intrusions.

The dates of intrusion are:

• 09/06/2021
• 09/07/2021
• 09/08/2021
• 09/09/2021
• 09/10/2021
• 09/11/2021
• 11/07/2021

Those dates are important because customers of at least two of the hosting providers were sent notices that referenced the same date of intrusion, September 6, 2021 according to information published by Wordfence. That implies that the root cause of additional data breaches are connected, if at least by date if not more.

Advertisement

Continue Reading Below

The notifications sent to GoDaddy customers and to at least two of the additional web hosts are also similar.

This is the text of part of the email sent to GoDaddy customers:

“We are writing to inform you of a security incident impacting your GoDaddy Managed WordPress hosting service.

On November 17, we identified suspicious activity in our WordPress hosting environment and immediately began an investigation with the help of a third-party IT forensics firm and have contacted law enforcement.

Our investigation is ongoing, but we have determined that, on or about September 6, 2021, an unauthorized third party gained access to certain authentication information for administrative services, specifically, your customer number and email address associated with your account; your WordPress Admin login set at inception; and your sFTP and
database usernames and passwords.

What this means is the unauthorized party could have obtained the ability to access your Managed WordPress service and make changes to it, including to alter your website and the content stored on it.”

The notice sent to GoDaddy customers is similar to the email notice sent to MediaTemple customers.

This is a part of the email sent to MediaTemple customers:

“…we have determined that, on or about September 6, 2021, an unauthorized third party gained access to certain authentication information for administrative services, specifically, the customer number and email address associated with your account; your WordPress Admin login set at inception; and your sFTP and database usernames and passwords.”