The web hosting and domain registrar giant GoDaddy went through a cyber attack in which the details of more than a million users – active and inactive – were leaked in its WordPress web hosting service. The company revealed the huge leak in an update they have sent to the U.S. Securities and Exchange Commission (SEC).
The Password for the System Has Leaked
According to GoDaddy’s announcement, the leak occurred last September – when a hacker managed to gain access to the company’s system, which was designed to build and configure users’ new websites in its WordPress web hosting service. GoDaddy says that the attacker was able to gain access to the system and extract the email addresses of more than a million users as a result of using a password for the leaked system.
Although the incident happened in early September, GoDaddy admits that they discovered the leak of a huge amount of their user information only last week – on November 17 – so the company also blocked that hacker’s access to users’ information through the leaked password, and contacted authorities.
Along with the leaks of 1.2 million leaked users, the storage and domain sales giant also noted that the attacker’s access to the company’s system also exposed him to admin passwords for WordPress sites set up using GoDaddy, and to details that allowed him to access active users’ databases. Along with all these details, the details published by the company indicate that the SSL keys of some of the users have also been leaked.
GoDaddy can not do anything about the leaked emails, other than to state that “they are now exposed to phishing attacks”. The company resets all leaked passwords and replaces the SSL keys of the exposed sites (all active sites), for the affected users so if you are an existing user or looking to register a new domain, the breach should not affect you. The company further said it had contacted all affected users and would update them on their details leaked following the attack.
History of Data Leaks
This is not the first time the American giant’s name has been linked to information leaks. In 2018, information from the company’s servers was revealed after these were stored in AWS’s unsecured Bucket. Last year, GoDaddy revealed that the details of “only” 28,000 users were leaked after access to the company’s systems by an “unauthorized person”. And it does not stop there. In 2020, the company’s employees also managed to fall into the trap of scammers who took management information from them to the websites of several crypto platforms – which they took down from the air.
It’s also interesting to read Wordfence to take on it. We hope that GoDaddy tech and management personnel learn its lessons from each and every incident, and strengthen its engineering practices to avoid such data leaks in the future.
From the 1-st of February 2021, an indirect commission will pay 1.5% irrespective of the category. These changes apply to traffic referred to Amazon.co.uk, Amazon.de, Amazon.fr, Amazon.it, and Amazon.es.
As an alternative to being able to earn more commissions with these changes, Amazon has expanded the number of product categories that include commission tiers. If the traffic that you send to Amazon results in sales that exceed the first tier, you can earn higher commission rates, not only on sales beyond the initial tier but on all sales that you generate in a product category.
An example of how this all works
Below are a few scenarios that describe how the changes may, or may not, affect you.
Scenario 1:Â Letâs say that you are a fashion-focused publisher who doesnât generate a lot of sales on Amazon, but the vast majority of your earnings result from purchases in product categories related to fashion. If you do nothing, you will likely earn a 10% commission (where your affiliate links to fashion products result in a purchase in the fashion category).
Scenario 2:Â Letâs consider the same scenario as above, but you *do* generate lots of sales. In this case, if the total qualifying revenue that you generate in fashion (where your affiliate links to a fashion product result in a purchase in the fashion category) is equal to or greater than ÂŁ15,000 in a calendar month, you could earn 12% commission on *all* of the fashion sales that result from your content (where your affiliate links to a fashion products result in a purchase in the fashion category).
Scenario 3:Â Now letâs say that you spend most of your clicks to pages other than product detail pages. For example, you spend most of your traffic to Amazonâs homepage. In this scenario, if you donât change your linking strategy (and potentially your content strategy too), you would likely see your earnings decrease as you would receive a commission of 1.5%, in most product categories.
Be sure to plan your affiliate store’s expansion or acquisition plans, accordingly. Check it out for the official Amazon statement.
GoDaddy’s Security challenges in 2020 haven’t ended. KrebsOnSecurity has found that hackers tricked many GoDaddy employees into transferring ownership or control of the web domains of several cryptocurrency services, inadvertently assisting in site shut down attacks. It is not known how many companies have fallen victim to these efforts, but Liquid.com and NiceHash have reported issues within days of each other. Bibox, Celsius, and Wirex could also be among the targets, although they have not confirmed anything at the time of this writing.
Exclusive: Fraudsters changed the email and DNS records for a number of cryptocurrency trading platforms this week, after successfully social engineering employees at GoDaddy, the world's largest domain name registrar. https://t.co/LYCdowb71Qpic.twitter.com/vlbSPsxPwI
It is unclear how the hackers succeeded, but the successful March campaign against sites like Escrow.com likely relied on Vishing, or voice calls aimed at phishing sites designed to harvest account logins. Attackers often try to convince employees that they are from the company’s IT department and simply want to solve technical problems.
A GoDaddy spokesman confirmed that âa limited number of employeesâ have been the victim of âsocial engineeringâ attacks that allow attackers to make unauthorized changes to domains and accounts. In response, he canceled the changes, blocked accounts, and helped the victims regain access.
This happened about a year after a data breach affecting 28,000 hosting accounts and didn’t help with GoDaddy’s image. Please be aware that it may have been difficult for the company to cancel the vishing. GoDaddy has joined many other companies to keep employees working remotely during the COVID-19 pandemic. This can make it difficult to verify the legitimacy of the caller or website. Thus, it can become a problem for many companies, even if it is safe to return to the offices.
Endurance International Group Holdings, which traded in NASDAQ under the ticker EIGI, entered into a definitive merger agreement to be acquired by the private equity firm Clearlake Capital Group in an all-cash deal valued at ~$3B.
âWe are pleased with this agreement which recognizes the value of our multi-brand scale platform. We are proud to serve approximately 5 million customers worldwide as a provider of solutions that help small and medium businesses succeed online and enhance the value of their customer relationshipsâ
Said Jeff Fox, President and Chief Executive Officer of Endurance.
âThe Endurance family of brands has built a leading position in the large and growing cloud hosting, domain, and digital marketing software space. We look forward to partnering with this talented team and supporting its long-term strategic plan to drive growth through its focus on customer value. We are excited to leverage Clearlakeâs O.P.S.ÂŽ framework to help the Company fuel growth both organically and through acquisitionsâ
Said Behdad Eghbali, Co-Founder and Managing Partner, and James Pade, Partner at Clearlake.
The transaction is expected to get finalized in the first quarter of 2021 when it will become a wholly-owned affiliate of Clearlake.
Endurance International Group Holdings, which we all refer to as EIG, is a holding company of many web hosting related brands such as BlueHost, HostGator, iPage, and more, for which it’s widely accepted that she cut costs by overselling host packages, providing weak support and the outages they have are much higher then what is normal in the hosting industry.
You may be confused because you see many EIG companies like BlueHost and HostGator referred to as the best hosting companies out there when the reality is different because those who review them are doing it mostly for the big affiliate commissions without any ethics to their audience.
Shopify, a leading eCommerce platform reveals an incident where two “rogue” employees stole data from fewer than 200 merchants in a breach that might have exposed customer emails, names, and order information.
Probably, no payment card numbers and other billing information were exposed. It’s important to mention that in a security sense, it’s not a ‘breach’, but more an internal leak. Now, it depends on what kind of 200 customers were leaked – if those are the top 200 Shopify merchants, it could be serious and devastating to those businesses.
Shopify terminated the employees and is working with the FBI and international agencies to investigate the breach.
Our investigation determined that two rogue members of our support team were engaged in a scheme to obtain customer transactional records of certain merchants. We immediately terminated these individualsâ access to our Shopify network and referred the incident to law enforcement. We are currently working with the FBI and other international agencies in their investigation of these criminal acts. While we do not have evidence of the data being utilized, we are in the early stages of the investigation and will be updating affected merchants as relevant.
Shopify is one of the leading eCommerce platforms these days, and was a highly recommended platform to start an online store with, together with WooCommerce. Let’s see what the investigation will find.
GoDaddy (NYSE: GDDY), announced today that it had entered into a merger and acquisition agreement to acquire SkyVerge, a WooCommerce extension developer with more than 60 premium WooCommerce extensions, spanning email marketing, memberships, payments & billing, and many more and used by over 100,000 online store merchants for their eCommerce sites.
SkyVerge is a highly favorite WoCommerce plugin developer among WordPress users and its plugins have been downloaded more than 3 million times. SkyVerge will continue to support its existing customers and product portfolio, as well as continue its contributions to other open-source software.
SkyVerge offering for WooCommerce plugins
Why is it important for GoDaddy? As you know, WordPress powers more than 30% of websites on the Internet, and about 17% of all WordPress sites use WooCommerce, making it one of the largest eCommerce platforms out there, together with Shopify and others. GoDaddy seeks a more vertical integration into the eCommerce stack, providing the hosting, domain services (which we recommended to avoid and use the alternatives and always separate hosting and domain registrar), and the site-level WordPress plugins.
As part of the M&A, All SkyVerge employees, including its co-founders and leadership team, will join GoDaddy.
According to the GoDaddy team:
“SkyVerge advances GoDaddy’s WordPress strategy and enhances our ability to deliver intuitive eCommerce experiences that help everyday entrepreneurs sell online,” said Patrick PulvermĂźller, President of the Partners Business at GoDaddy. “The SkyVerge team is incredibly talented and its WooCommerce expertise will play an instrumental role in accelerating the development of future WordPress eCommerce solutions.”
The SkyVerge team said:
“We’re thrilled to join GoDaddy, a company that shares our passion for helping everyday entrepreneurs succeed online,” said Max Rice, cofounder of SkyVerge. “Our team is excited to bring our top-rated WooCommerce extensions to GoDaddy customers and continue to innovate and push the future of eCommerce on WordPress forward.”
EDIT:
It’s worth mentioning the update SkyVerge pushed on the 24/08/2020 (version 1.18.0) of its Membership extension that adds a SkyVerge dashboard as a root menu on the administrator page, a few weeks before this acquisition is announced, which could lead to its use by GoDaddy as a platform to up-sell hosting (which we recommend to avoid, together with hosting offerings by EIG) and other services they offer.
Recent Comments