The recent GoDaddy breach that affected more than 1.2 million users is not limited to this web hosting company, but has affected a large number of resellers.
A day after the breach, the company announced how tsoHost, Media Temple, 123Reg, Domain Factory, Heart Internet, and Host Europe were also affected.
As Wordfence reported, GoDaddy VP of Corporate Communications Dan Rice said: “A small number of active and inactive managed WordPress users from these brands have been affected by the data loss incident. No other brands are affected. These brands have already contacted their respective customers with specific details and recommended actions. "
Wider impact
While tsoHost, 123Reg, Domain Factory, Heart Internet, and Host Europe were acquired by GoDaddy in 2017, Media Temple was acquired in 2013.
Media Temple and tsoHost have already started sending emails to notify users of the data breach.
It appears that all affected hosts are using the same URL, starting with https://myh.secureserver.net/#/hosting/mwp/v1/ for provisioning, account management, and configuration of their WordPress managed offerings. Also, they store sFTP passwords that can later be found in the clear.
According to the previous report, a malicious actor used a compromised password to access the GoDaddy database around September 6. It took GoDaddy over a month to detect the intrusion as it said it discovered the breach on November 17.
The 1,2 million active and inactive users who were compromised in this attack had their email addresses and customer numbers exposed, the company added. He warned that these sites are at additional risk of phishing attacks, and said that the original WordPress admin password, which is created with the first WordPress installation, is also exposed. This means that if webmasters don't change the "factory" password, their websites could be particularly at risk.
GoDaddy has more than 20 million customers around the world.