MalwareTechnologyInformationBackdoorStolen CredentialsData EncryptedCustomer Data InvolvedCredentialsAuthenticationLowResolved

GODADDY.COM, LLC

bd_bf9cb552a1c0179c · schema v1 · pii pii-v1

Severity

Low

Discovered

—

Filed

May 17, 2023

To disclose

—

Affected

Not disclosed

Confidence

65%

Full breach record for GODADDY.COM, LLC →5 incidents on file

GoDaddy.com LLC notified the California AG of a security incident affecting VPS servers. Malware replaced SSH binaries, allowing unauthorized third-party remote access and capturing SSH passwords. The incident occurred in October 2019. GoDaddy eliminated the malware, reinstalled good binaries, and removed affected backups. Customers were advised to reset credentials and audit servers.

J jump to incidentP pin to compareR raw source

Incident timeline

Oct 1, 2019

Begins

May 17, 2023

Filed

Tracked as a single-filing incident — the only disclosure on record for this event so far.ConfirmedView incident

Name: GODADDY.COM, LLC
norm: godaddycom

Name: GODADDY.COM, LLC
norm: godaddycom
Industry: Technologyllm

Discovered: —
Breach occurred: Oct 1, 2019 – Oct 31, 2019
Materiality determined: —
Notification sent: —
Affected individuals: Not disclosed
Data types: CredentialsAuthentication
Attack vector: Unknown
MITRE ATT&CK: T1056 Input CaptureT1078 Valid Accounts
Threat actor: External

During the incident: Eliminated the malware from your server
Reinstalled packages containing known good SSH binaries
Removed any affected backups from your account
Changes made: Reset all credentials for your server including your SSH passwords and keys
Conduct an audit of your server for any other unwanted or modified files
Source: Quoted from the filing itself, not independently verified.

Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://oag.ca.gov/ecrime/databreach/reports/sb24-566826
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: May 17, 2023
Raw hash: 5f938f70e936c59ebf51d896d7304515c58727fd2ad79d10bcbb591e7dd9cc1a

Reporting entityGODADDY.COM, LLC

Victim entityGODADDY.COM, LLC

IncidentUnknown

Stated responseEliminated the malware from your server

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenanceoag.ca.gov