GoDaddy Says AI-Driven Cyberattack Exposed Website Customer Information

(VINnews) – GoDaddy said an AI-driven cyberattack exposed profile, settings and contact information associated with its Websites + Marketing product, though the company said the attacker did not obtain passwords or access customer accounts.

The incident occurred Sept. 18 and was detected the following day, according to a notice sent to customers. The attacker obtained information through an application programming interface, or API, including contact details customers had supplied for publication on their websites.

GoDaddy said its investigation found that the attacker’s activity was limited to reading the exposed information. The company said there was no evidence that the attacker changed websites, accessed accounts or took other actions affecting customer products.

The company described the incident as its first known AI-driven cyberattack. It said it responded immediately, engaged cybersecurity experts and worked with industry partners to stop the activity.

GoDaddy also reported the incident to law enforcement and voluntarily notified the Federal Trade Commission and data protection authorities in the United Kingdom and European Union.

The company said the incident had been contained and that it had taken additional steps to defend against similar attacks.

GoDaddy urged customers to remain alert for suspicious emails and phone calls, warning that exposed contact information could be used in phishing attempts. The company recommended enabling two-step verification, which adds an extra layer of security to accounts.

GoDaddy said it would never request passwords, payment details or verification codes by email, text message or phone.