“While GoDaddy discovered the security breach following customer reports in early December 2022 that their sites were being used to redirect to random domains, the attackers had access to the company’s network for multiple years.”
GoDaddy now admits its March 2020 and November 2021 breaches were the same crew, which never left. The 2021 one exposed WordPress admin passwords and SSL private keys for 1.2 million customers. GoDaddy hosts 20 million customers and learned about this one from customers complaining that their sites redirected to junk. The disclosure came in an SEC filing, where the shareholders read it before the victims did.