Web hosting company GoDaddy said that email addresses of 1.2 million active and inactive users had been exposed to an unauthorised access of their systems.
GoDaddy said that it noticed the intrusion on November 17, and that an unauthorised third party had accessed the system using a compromised password.
According to a disclosure filing filed by GoDaddy to the US Securities and Exchange Commission, the hackers had access to more than just mails. The hack exposed original WordPress admin passwords, as well as active users’ databases and sFTP systems. Some customers also had their private SSL keys exposed.
GoDaddy says it has reset affected passwords and regenerated security passwords where needed. It is also contacting all impacted customers where needed.
Also Watch: How phones get hacked (and how you can stay safe)
In the filing, Demetrius Comes, the Chief Information Security Officer of GoDaddy, said:
“Our investigation is ongoing and we are contacting all impacted customers directly with specific details.
We are sincerely sorry for this incident and the concern it causes for our customers. We, GoDaddy leadership and employees, take our responsibility to protect our customers’ data very seriously and never want to let them down. We will learn from this incident and are already taking steps to strengthen our provisioning system with additional layers of protection.”