One of the largest and most popular domain registrar and web hosting companies, GoDaddy, announced a breach which it discovered on November 17th. The threat actors are believed to have had access to the network since at least September 6th. The affected network hosted the company’s Managed WordPress environment, a service that allows their customers to easily host WordPress instances on GoDaddy’s network. The attackers had access to up to 1.2 million active and inactive WordPress instances. The hackers had access to the email addresses associated with the instance, the default credentials to the admin account for each instance, sFTP and database usernames and passwords, and for some customers, the SSL private key. GoDaddy has reset these credentials and is working on generating new SSL certificates for the affected customers. They have also started an investigation working with law enforcement and an IT forensics firm that is still ongoing. If relevant updates are released, the Ankura CTAPT will publish that information for our readers.