“Based on our investigation, we believe these incidents are part of a multi-year campaign by a sophisticated threat actor group that, among other things, installed malware on our systems and obtained pieces of code related to some services within GoDaddy,” the web hosting company said in a regulatory filing.
GoDaddy said that although the most recent breach was uncovered after customer notifications in December 2022 that their sites were being redirected to other domains, the campaign also involved previous breaches disclosed in November 2021 and March 2020.