Over a million GoDaddy WordPress customers had email addresses exposed in latest breach

GoDaddy has suffered a security breach that gave an attacker access to more than 1 million email addresses belonging to the company’s active and inactive Managed WordPress users, according to a disclosure it filed with the SEC on Monday.

The company says the attacker gained access to a provisioning system (meant to set up and automatically configure new sites when customers create them) in early September by “using a compromised password.” GoDaddy says that it noticed the intrusion on November 17th and immediately locked the attacker out before beginning an investigation and contacting law enforcement.

The hackers had access to more than just the email addresses — they could also see the original WordPress admin passwords set by the provisioner, as well as the credentials for active users’ databases and sFTP systems. The company also says that some customers had their private SSL keys exposed, which are responsible for proving that a website is who it says it is (powering the little lock icon you often see in your browser’s address bar).

According to GoDaddy, it’s working to mitigate the issues by resetting affected passwords and regenerating security certificates if needed. The company also says that it’s “contacting all impacted customers directly with specific details.” While those seem like appropriate steps, having to deal with a reset password will probably be a nuisance for some of its users.

GoDaddy didn’t immediately respond to a request for comment about how the attacker gained access to the password the company says was used to gain access to its systems. Its announcement does say, however, that its investigation is ongoing.

In recent intrusions at other companies, phishing or social engineering has been to blame (though there have also been instances of simply poor password security). GoDaddy itself has some pretty upsetting history with testing its employees’ cybersecurity awareness when it comes to fake emails, but attackers really only need to get lucky once to access treasure troves of data.