GoDaddy AI-Driven Cyberattack: What Happened and What to Do

GoDaddy says an attacker used an API to read profile information, account settings and public contact details from its Websites + Marketing product on 18 September 2026, in what it calls its first known AI-driven cyberattack. GoDaddy detected the intrusion the next day. It says the attacker did not obtain passwords or access customer accounts, and that it found no evidence that any website was changed.

Below, we set out the confirmed facts and what 123 Reg told its own customers, then explain how to check whether your account is in scope. After that comes a short website security checklist you can work through this week.

What happened in the GoDaddy AI-driven cyberattack?

GoDaddy says threat actors used an API to read customer information from Websites + Marketing on 18 September 2026, and that it detected the intrusion the following day. The company has described the incident as an AI-driven cyberattack, and the dates come from a notice it sent to customers, which VINnews reported.

Detection came about one day after the intrusion, while public reporting followed several weeks later.

How did the attacker reach the data?

An API is a doorway that lets one piece of software request data from another. In this case, an unauthorised third party used that doorway to read stored information rather than break in to change files. GoDaddy says its investigation found the activity was limited to reading data.

What is still unknown?

GoDaddy has not said how many customers were affected, which countries they are in, or how the attacker got API access. Its UK registrar 123 Reg has given more detail on the AI side: according to The Register, it found AI attack "skills" on the attacker's servers, including copies of skills Anthropic had released as open source. Treat GoDaddy's own notice in your account dashboard as the main record.

What customer data was exposed, and what was not?

GoDaddy says the attacker read three kinds of information through an API linked to Websites + Marketing, and it is equally clear about what was not touched.

Why do public contact details still matter?

The contact details on your website are already public, but gathered in one place and matched to real customers, they become far more useful to scammers. A criminal with that list can send a believable message naming your business and your web hosting provider. The main risk is not a hijacked account – it is the convincing phishing that may follow by email, SMS or WhatsApp.

What is the GoDaddy controversy?

The controversy is largely about trust, because customers want to know exactly what was read and why the attack was called AI-driven. Those questions sit against a record of earlier incidents at the company.

In March 2020, a threat actor compromised the hosting login credentials of over 28,000 hosting customers, as CSO Online reported. In 2021, an unauthorised third party used a compromised password from about 6 September to reach the Managed WordPress provisioning system; GoDaddy discovered it on 17 November, and up to 1.2 million customers were affected, according to Security Affairs. Then in December 2022, an unauthorised third party gained access to cPanel hosting servers and installed malware.

GoDaddy later linked these attacks to a multiyear hacking campaign, which CSO Online reported also obtained code related to some GoDaddy services. Coverage of the November 2021 incident noted that exposed email addresses create a phishing risk, and that history explains why many owners are reading this latest incident closely.

What did 123 Reg tell its customers?

123 Reg is a UK domain registrar owned by GoDaddy. It began emailing its customers in late October about an attack on 18 September, the same date as GoDaddy's incident, though neither company has said publicly that the two are one intrusion. According to The Register, 123 Reg said:

• Data exposed: names, phone numbers, countries, language and currency preferences, account creation dates, products on the account, marketing preferences and company VAT numbers. The attacker's activity was limited to reading, but 123 Reg says "it's possible they created copies".
• The tool: ARTEX, an open-source, Chinese-developed agentic penetration-testing tool released in July 2026, was used in the attack.
• The servers: IP addresses it assessed as the attacker's core infrastructure were hosted in China and Singapore, and it worked with Singapore internet providers to shut them down.
• The suspect: 123 Reg suspects a Chinese state-sponsored group, linking the attack to activity CrowdStrike reported on 7 October 2026 against South Korean financial organisations.

What is confirmed and what is suspected?

The tool and the server locations are 123 Reg's own findings. The attacker's identity is a suspicion: ARTEX is open source, so anyone could have used it, and server locations show where traffic came from, not who sent it. Until GoDaddy or a government agency names the attacker, treat attribution as unconfirmed.

What is an AI cyber attack, in plain terms?

In an AI cyber attack, software does most of the work a person once did. Older attack scripts followed a fixed list of steps, whereas agentic tools are given a goal, such as collecting contact details, and then plan, test and adjust on their own, around the clock.

APIs are attractive targets because they answer requests quickly and tidily. As a general illustration, not a description of this incident, a tool might request record 1001, then 1002, then 1003, and if nothing limits those requests or checks who is asking, it can copy a lot of data fast. Automated tools cast a wide net, so a small business website is as much in scope as a large company's.

How do I know if my site or account is affected?

You are most likely in scope if you use Websites + Marketing, and 123 Reg customers have also been notified. Whichever service you use, check by logging in directly rather than through an email link.

• Websites + Marketing users: watch for a breach notification email, but do not click its links. Type the GoDaddy address yourself and check messages inside the dashboard.
• 123 Reg customers: open a fresh browser tab, log in to 123 Reg directly and read any notice there.
• Other GoDaddy products: log in directly and treat any "urgent breach" message with care until confirmed.

If you are unsure, contact support through the official website, and never use a phone number given in an email.

What should website owners do now? A website security checklist

This checklist takes under an hour, and it is sensible after any security breach, even if your account was never in scope.

1. Change your password and stop reusing it. Log in by typing the address yourself, set a long, unique password stored in a password manager, and change it anywhere else you used it.
2. Turn on two-step verification. An authenticator app is usually stronger than SMS codes. The US Cybersecurity and Infrastructure Security Agency says businesses should aim to use a phishing-resistant MFA method.
3. Review your public contact details and account settings. Remove anything that need not be public, and confirm your recovery email and phone still belong to you.
4. Check connected apps, API keys and team access. Revoke anything you do not recognise, create fresh keys for tools you keep, and remove former staff and agencies.
5. Confirm you have a recent, off-site backup. Download a full copy of your site files and database, and store it away from your host.
6. Tell your team and clients what to watch for. Ask them to distrust unexpected renewal notices, payment requests or login links, and to check by phone first.

Not sure your site is safe? Get a free website security check from CloudFigma: Free website security check.

How can exposed contact details be used against you?

Scammers can use exposed names, emails and phone numbers to write personal-feeling phishing messages, often posing as your host or registrar and leaning on urgency. Be wary of:

• a fake domain renewal email claiming your domain expires today;
• a payment request with a new UPI ID or bank account;
• an SMS with a shortened link asking you to "verify" your account;
• a WhatsApp message from an unknown number using your host's logo.

Before you click or pay, ignore the link and type your provider's address yourself, then check your real renewal date and invoices inside your account and pay only through the dashboard. You can also report suspicious calls, SMS and WhatsApp messages on the Chakshu portal on Sanchar Saathi, a step HDFC Bank advises. If you have already lost money to a scam, call the national cyber-crime helpline on 1930 or report it at cybercrime.gov.in.

What should you ask any host about security?

Clear, specific answers matter more than a long feature list, so put a few plain questions to any provider before you trust it with your business.

• Which two-step verification methods do you offer? Ask whether a phishing-resistant option is available.
• How often do you back up, and how long are backups kept? Self-service restores save hours when support is busy.
• How do you protect against attacks and malware? Ask about DDoS protection and malware scanning.
• Who watches the servers, and when? Problems do not keep office hours.
• How is API access controlled and logged? Ask who can create keys and whether you can see access logs.

How CloudFigma handles this

These are fair questions for us too, so here are our plain answers for CloudFigma hosting:

• Backups: every plan has daily backups, kept for 30 days.
• Attack protection: every plan includes DDoS protection.
• Malware: every plan includes malware scanning.
• Monitoring: our servers are monitored 24/7.

Keep your website safe

The GoDaddy incident is a reminder that any provider can be targeted, yet the steps that protect you are mostly simple. Use unique passwords and two-step verification, keep an off-site backup, and treat urgent emails with care by checking inside your account instead.

Your host should carry part of the load too. On every plan, we keep daily backups for 30 days, include DDoS protection and malware scanning, and monitor our servers 24/7, which means a clean copy to restore and a team watching from day one.

If you want a second pair of eyes, we will check your site for free, and if you decide to move, migration is free. Running WordPress? Our WordPress hosting lets you move your site across without rebuilding it. Real answers, no pressure.