When Low-Tech Hacks Cause High-Impact Breaches
Summary: GoDaddy disclosed in an SEC filing that the same "sophisticated threat actor group" carried out three intrusions: a March 2020 spear-phishing attack that compromised the hosting login credentials of approximately 28,000 customers, a November 2021 compromised password that let attackers steal source code and data tied to 1.2 million customers, and a December 2022 breach in which hackers installed malware on cPanel hosting servers that intermittently redirected random customer websites to malicious sites. KrebsOnSecurity reported that the March 2020 attack began with a caller who tricked a GoDaddy employee into giving up credentials, then phoned Escrow.com's general manager reading from admin panel notes to authorize a domain change.
Why it matters: A single employee persuaded over the phone exposed the login credentials of roughly 28,000 customers, and the November 2021 intrusion went undetected for about two months while source code and data on 1.2 million customers were taken. Google reported no successful phishing of its 85,000+ employees on work accounts since early 2017, when it required physical security keys, a control the source notes cannot be phished by these calls.
Read the original at Krebs on Security ↗
- Topics
- Threat Actors & Nation-State
- Related
- University of Texas at Arlington warns personal information stolen during cyberattack Cyber Risks · Nov 13, 2026Hackers Exploit PHP2Shell Flaws in Check Point Gateways to Deploy TSGA Backdoor and Wipe ESXi Files Cyber Risks · Nov 13, 2026Hackers compromise 4,800 GitHub accounts to steal cloud credentials Cyber Risks · Nov 12, 2026