Industry News: ESG5

The target: GoDaddy, a U.S based website domain registrar and web hosting company.

The take: 1.2 million records of customer information including: email addresses, SSH keys, and database usernames and passwords.

The attack vector: The threat actor gained access to GoDaddy’s hosting servers through a compromised employee account, granting them the same access to all the systems the firm’s user had. Multi-factor authentication was not enabled.

This breach highlights not only the ever-present threat that compromised employee accounts pose to firms, but also the critical importance of proper credential management. Employing Multi-factor authentication is a key part of maintaining a robust cybersecurity posture and ensuring company and customer data Is only accessed by authorized parties.

Read more...