GoDaddy Security Review After September 2026 AI Cyberattack
In short
An attacker accessed GoDaddy’s Websites + Marketing product via API on September 18, 2026. The company described the event as its first known AI-driven cyberattack and limited the impact to read-only access of profile and contact data.
GoDaddy reported an API intrusion on September 18, 2026, that reached its Websites + Marketing product and allowed an attacker to read customer profile information, account settings, and public contact details. The company called the event its first known AI-driven cyberattack. No passwords, payment data, or account login credentials were obtained.
GoDaddy detected the activity the next day. It engaged external experts, notified law enforcement, and reported the incident to the FTC and data protection authorities in the UK and EU. Customer notifications began in late October 2026.
Incident Scope and Related 123 Reg Breach
The attacker read only data already supplied by customers for public website display. No evidence of website modifications or further product access appeared during the investigation. GoDaddy stated that the incident remained contained after initial detection.
GoDaddy’s UK subsidiary 123 Reg disclosed a parallel September 18 intrusion that exposed similar account and product data through an API. That breach included names, phone numbers, VAT numbers, marketing preferences, and account creation dates. 123 Reg also labeled the event an AI-driven attack and noted possible data copies.
Both companies assessed infrastructure traces pointing to servers in China and Singapore plus use of open-source AI exploitation tools. No confirmed link to a specific state actor has been established. The overlap in timing and method suggests coordinated activity against the same corporate parent.
| Aspect | GoDaddy Websites + Marketing | 123 Reg |
|---|---|---|
| Date of access | September 18, 2026 | September 18, 2026 |
| Data read | Profile, settings, public contacts | Names, phones, VAT, products, preferences |
| Passwords taken | No | No |
| Payment data | No | No |
| Notification start | Late October 2026 | Late October 2026 |
User Risks and Practical Steps
Exposed contact details create an elevated phishing risk. Attackers can craft messages that appear to come from known business contacts listed on customer websites. Users should treat any unsolicited email or call referencing their GoDaddy account with extra scrutiny.
Recommended actions include verifying all communications directly through the official GoDaddy or 123 Reg portals rather than links in messages. Enable two-factor authentication on every account that supports it. Monitor email inboxes and phone logs for unusual activity tied to the exposed contact information.
GoDaddy has stated it is adding further defenses against AI-assisted attacks. Customers should watch for additional regulatory updates or guidance issued by the FTC and European data authorities as investigations continue. No widespread functional impact on hosted websites has been reported to date.
Frequently asked questions
What data did the September 2026 GoDaddy attack expose?
The attacker read profile information, account settings, and public contact details supplied by customers for their Websites + Marketing product. No passwords or payment information were accessed.
Did GoDaddy notify affected customers?
Notifications began in late October 2026 after the September 18 intrusion. The company also reported the incident to the FTC and UK and EU regulators.
Is there a connection to the 123 Reg incident?
Both occurred on the same date through similar API access. 123 Reg reported exposure of additional fields such as VAT numbers and marketing preferences while using the same description of an AI-driven attack.
What should users do after the GoDaddy data exposure?
Verify all communications via official login pages, enable two-factor authentication, and monitor for phishing attempts that use the exposed contact details.
TrustScope
Comments 1