Summary
- Environment: Web hosting
- Operational impact: Multiple linked intrusions treated as one long-running compromise
- Financial impact: No financial figure is established by the reviewed source evidence
- Record status: Developing record. Reviewed September 19, 2026; updated as evidence emerges.
What happened
In 2020–2023 (disclosed as one connected campaign in 2023), GoDaddy experienced an incident in its web hosting environment. The retained source describes the attack path as follows: Same threat actor over 3 years; SSH keys, source code, customer credentials. [1]
The documented consequence was: Multiple linked intrusions treated as one long-running compromise. [1]
Impact
- Documented impact: Multiple linked intrusions treated as one long-running compromise. [1]
- No financial loss, ransom amount, recovery cost, or regulatory penalty is established by the reviewed source evidence.
Threat Group & Attack Vector
The retained source describes the attack path as follows: Same threat actor over 3 years; SSH keys, source code, customer credentials. The canonical record does not add intrusion steps beyond those supported by the source. [1]
Actors
- No threat actor group has been identified in the reviewed public evidence.
TTPs
- T1213 — Data from Information Repositories — mapped from the cited behavior. [1]
Response
The retained source describes containment action intended to limit further access or disruption. [1] The retained source describes a forensic or specialist investigation of the incident. [1]
This account is bounded to GoDaddy Form 10-K. Details absent from that evidence are left unresolved rather than inferred. [1]