GoDaddy AI cyberattack 2026, what was exposed and what website owners should do now

The GoDaddy AI cyberattack of 18 September 2026 did not take passwords, but it did hand an attacker a structured list of GoDaddy website builder customers and the contact details those customers publish. That combination is what matters. According to the notification GoDaddy sent to Websites + Marketing (W+M) customers, a third party pulled profile and settings information, including any contact details the customer had supplied for publication on their site, through an application programming interface (API). GoDaddy detected the activity on 19 September and calls it "the first known AI-driven cyberattack against our company".

GoDaddy says the attacker did not obtain passwords, did not access accounts, did not change websites and took no other action on customers' products. The company says the incident is contained, that it reported it to law enforcement, and that it voluntarily notified the US Federal Trade Commission and data protection authorities in the UK and EU. Customers began posting the email publicly on 28 October 2026.

On the same day, GoDaddy-owned UK registrar 123 Reg disclosed an attack on the same date, described with identical wording, that exposed a wider set of data including names, phone numbers and company VAT numbers. Its spokesperson told The Register that early evidence points to a China-linked actor using AI tooling. GoDaddy has not said the two incidents are the same operation, but they appear linked.

This article covers what the GoDaddy notification confirms and what it does not, why "read only" exposure of public contact data still creates a real phishing risk, what the 123 Reg disclosure adds, what "AI-driven" means in practice, and what GoDaddy customers and other website owners in the UAE should and should not do next.

GoDaddy AI cyberattack 2026 at a glance

The GoDaddy AI cyberattack timeline is short and, so far, rests on two customer notifications rather than a public GoDaddy statement. As of 28 October 2026 we could find no GoDaddy newsroom post or regulatory filing about it. Everything below comes from the W+M customer email as reproduced publicly and from 123 Reg's disclosure to The Register.

Two things are missing from that table and matter for anyone assessing risk. GoDaddy has not said how many customers were affected, and it has not said which API was involved or how it was reached. Readers should treat any article that states a customer count or a specific vulnerability as speculation until GoDaddy confirms it.

What the GoDaddy notification actually says

The GoDaddy notification is precise about what was read and what was not, and the distinction is the most useful thing in it. The table below separates the two, using GoDaddy's own description.

GoDaddy also says it defended against the attack, prevented interruption of its services, and has taken further steps to defend against AI-driven attacks in future. It does not describe those steps.

Three things the notification does not establish are worth stating directly. It does not say domain registration data, payment details or email account contents were touched. It does not say every W+M customer was affected, only that the recipient's information was. And it does not say customers who use other GoDaddy products, such as Managed WordPress or cPanel hosting, were involved. If you received the email, your W+M data was in scope. If you did not, nothing published so far suggests your GoDaddy products were.

Why public contact details are still a real exposure

Public contact details look harmless on their own, and that is the argument most coverage of the GoDaddy incident will make: the attacker only read information customers had already chosen to publish. The argument misses what the API actually gave away.

A business phone number on a single website tells a scammer very little. The same number, pulled through GoDaddy's own API alongside the site's profile and settings, tells them four things at once: this business exists, it builds its website with GoDaddy, it uses this specific product, and this is how to reach the person who manages it. Collected for thousands of sites in one sweep, that becomes a ready-made target list for messages that pretend to come from GoDaddy.

That is the insight worth holding onto. Exposure is not only about whether data was secret. It is about whether data was connected to something that makes impersonation believable. A phishing email that says "your GoDaddy website needs attention", sent to the exact address listed on your GoDaddy-built site, and perhaps quoting a setting from your account, is far more convincing than a generic scam. Scraping each site one page at a time could rebuild some of this, but slowly, noisily and without the settings data. An API hands it over in clean, structured form.

The same logic explains why GoDaddy and 123 Reg both told customers the attacker did not get passwords, and both stressed two-step verification. The data taken is the raw material for the next step, which is persuading the customer to hand over a password or a verification code themselves.

The 123 Reg disclosure and what it adds

The 123 Reg disclosure, reported by The Register on 28 October 2026, is the more detailed of the two accounts and changes how the GoDaddy incident should be read. 123 Reg is a UK domain registrar owned by GoDaddy. It described an intrusion on 18 September in the same words GoDaddy used for W+M, as the first known AI-driven cyberattack against the company.

The data 123 Reg says was affected is broader than the W+M list. According to its spokesperson, it included customer names, phone numbers, countries, language and currency preferences, account creation dates, products on the account and marketing preferences, plus company VAT numbers, related customer relationship data and product information drawn from an API.

Three further points from the 123 Reg spokesperson are relevant to GoDaddy customers generally.

• Attribution. 123 Reg said the core attacker infrastructure was hosted in China and Singapore, and assessed a strong Chinese nexus. It also said it found AI attack tooling on that infrastructure, including copies of skills open sourced by Anthropic, along with other AI exploitation frameworks and scripts.
• A possible link to a wider campaign. The registrar suspects the same actor may be behind the ARTEX-assisted intrusions at South Korean financial firms that CrowdStrike reported on 7 October 2026, because the timing and tooling overlap.
• Copies may exist. Its customer email used the same "limited to reading" wording as GoDaddy's, but the spokesperson told The Register that "it's possible they created copies of the information", and that this possibility is why customers were notified.

Read together, the two notices point to a practical conclusion. "Limited to reading" describes what the attacker could do inside GoDaddy's systems. It does not mean the data stayed there. Reading data over an API delivers it to whoever is reading. Website owners should plan on the assumption that the exposed W+M details are now held by someone else.

To be clear about the limits: GoDaddy has not confirmed that the W+M incident and the 123 Reg incident were one operation, and the China-nexus assessment is 123 Reg's, made about its own investigation. The shared date, shared parent company and identical description make a connection likely. It is not proven.

What an AI-driven cyberattack means in this case

An AI-driven cyberattack, in the sense security researchers use it in 2026, is one where AI systems carry out a large share of the operational work: mapping a target, finding weak points, writing or adapting code, and running many requests at a speed no human team would sustain. The human operator sets objectives and steps in at key decisions.

That is a meaningful change from AI as an assistant that drafts phishing emails. GoDaddy's own annual cybersecurity report, published in June 2026 and covering 2025, already described AI as accelerating malware development and lowering the barrier to entry for less skilled attackers. The September incidents suggest the next stage, where AI tools are pointed directly at a company's systems.

For the GoDaddy W+M incident specifically, here is what is known and what is not.

Any article claiming to know the exact exploit is going beyond the evidence. What can be said with confidence is the general shape of the risk, which is covered next.

How AI changes API attacks on business websites

API attacks have always depended on finding an interface that returns more than it should, or returns it to someone it should not. What AI changes is the cost of finding and exploiting that gap.

An API is the connection that lets one piece of software ask another for data. Every modern website builder, booking plugin, payment gateway and CRM integration relies on them. Most APIs are well protected. The weak ones tend to share a few traits: they trust requests that look legitimate, they return whole records when a page only needs one field, or they do not notice when a single client asks for thousands of records in a short time.

Historically, finding such a weakness took a skilled person time. Agentic AI tools compress that work. They can read documentation, try variations, interpret error messages and adjust, then run the successful request at scale. CrowdStrike's analysis of the ARTEX campaign against South Korean financial firms, as reported by The Hacker News, described an attacker combining an open-source agentic testing tool with several large language models to speed up intrusions. The tool's developer has since taken the project closed source, citing misuse.

The last row is the important one for business owners. AI does not create new categories of weakness. It finds existing ones faster. A website whose integrations return only what they need, whose admin accounts use two-step verification, and whose activity someone actually watches is in the same position it was in last year. A website with forgotten plugins, shared logins and integrations nobody has reviewed since launch is in a worse one.

Review your integrations and APIs Ongoing monitoring under AMC

Was your GoDaddy website or account compromised

Your GoDaddy website or account was not compromised in the sense of someone logging in or changing it, according to everything GoDaddy has said. Your published details, profile and settings may have been read if you use W+M. The answers below reflect only what the two notifications state.

The phishing risk that follows a GoDaddy data exposure

The phishing risk after a GoDaddy data exposure is the part of this incident most likely to cost a business money. Neither GoDaddy nor 123 Reg has reported phishing that reuses the September data, and nothing here suggests it has happened. The point is to recognise the likely shapes before they arrive.

Scams that follow a hosting provider incident tend to borrow the provider's name and an urgent reason to act. Typical examples include:

• Fake security notices. An email saying that, because of the recent incident, you must confirm your account, reset your password or verify your identity through a link.
• Fake renewal or suspension warnings. A message claiming your domain, website plan or SSL certificate will lapse unless you pay or sign in within hours.
• Fake support calls or texts. Someone claiming to be from GoDaddy support who already knows your business name and site details and asks you to read back a verification code.
• Fake invoices. Particularly risky for businesses whose VAT number or company details appear in the 123 Reg data, because an invoice quoting correct details looks routine to an accounts team.
• Fake "AI security upgrade" offers. Messages playing on the AI angle of the news to sell a bogus security product or plugin.

The common thread is that the message asks you to do something outside your normal routine, through a channel the sender chose. 123 Reg's notice was explicit that it will never ask for passwords, payment details or verification codes by email, text or phone, and told customers who are unsure to go to the company's website directly and sign in there. That rule applies to GoDaddy and to almost every legitimate provider.

Our existing guide to identifying and reporting phishing emails covers the general warning signs in detail, so we will not repeat them here.

What GoDaddy customers should do this week

GoDaddy customers do not need to rebuild or move their websites because of this incident. The useful actions are about closing the routes an attacker would try next. These are the same priorities both notices point to, set out in order of impact.

GoDaddy and 123 Reg both publish instructions for turning on two-step verification inside their account settings. Follow the provider's own help pages for the exact steps, because menus change and copied instructions go out of date.

Do not confuse this with the GoDaddy SSL certificate revocation

The GoDaddy SSL certificate revocation is a separate event that happened in the same weeks, and mixing the two up will lead to the wrong response. On 21 October 2026 GoDaddy revoked 404,607 SSL/TLS certificates that had been issued with details that did not match its published certificate policies. That was a compliance problem, not an attack, and it has nothing to do with W+M data.

It matters here for one reason. "Your certificate has been revoked, act now" is exactly the kind of true-sounding story a phishing message can borrow. If your site uses a GoDaddy certificate, confirm its status from inside your account or with whoever manages your hosting, not from a link in an unexpected email. If you are not sure who manages your certificate, that is worth finding out regardless. Tomsher's SSL certificate service covers installation and renewal for clients who want it handled.

GoDaddy's earlier security incidents and the 2025 FTC order

GoDaddy's earlier security incidents give useful context, but they are not evidence about what caused the September 2026 attack. They should be read as background only.

Between 2019 and 2022 GoDaddy disclosed several compromises of its hosting environment. In January 2025 the US Federal Trade Commission alleged that, despite advertising strong security, GoDaddy had failed to use multi-factor authentication, monitor for security threats and secure connections to consumer data, and that these failures led to several breaches. On 21 May 2025 the FTC finalised an order, by a 3-0 vote, that:

• prohibits GoDaddy from misrepresenting its security or its compliance with privacy and security programmes
• requires GoDaddy to establish and maintain a comprehensive information security programme for its website hosting services
• requires an independent third-party assessor to review that programme

The order concerns earlier conduct. It is not a finding about the 2026 incident, and nothing published so far says GoDaddy breached it. What the history does explain is why customers and regulators will look closely at how GoDaddy handles this one, and why GoDaddy says it notified the FTC voluntarily.

When you do not need to do anything more

Many website owners reading about the GoDaddy cyberattack need nothing beyond a short check, and it is worth saying so plainly.

• You are not a GoDaddy W+M or 123 Reg customer. Nothing published so far suggests your data was involved. The general habits above are still sensible, but there is no incident-specific action.
• You are a W+M customer and two-step verification is already on for both your GoDaddy account and the email account behind it. Brief anyone who handles renewals or invoices, and you have covered the main risk.
• Your site publishes only a generic role address and an office number. The exposed data is less useful to an attacker, and the main defence is the same direct sign-in habit.
• Someone already manages your website, domain and email under a maintenance contract. Ask them to confirm the points in the table above, rather than paying a second firm to repeat it.

What we would not recommend is moving providers in a hurry because of this incident alone. A migration done under pressure, with DNS, email and certificates moved at once, causes more outages than the incident it is meant to avoid. If you were already unhappy with your platform, this is a fair prompt to plan a move properly. That is a different decision.

What this means for UAE businesses running their own websites

For UAE businesses, the GoDaddy incident is a reminder that a website is part of how customers reach you, and that the contact details it publishes are part of your attack surface. Many small and medium businesses in Dubai and across the Emirates build on hosted builders, including GoDaddy's, because they are quick to launch. They often list a mobile number used for enquiries, a personal email address and sometimes a trade licence or VAT reference.

Three practical consequences follow.

1. Phishing reaches the person who can approve payments. In a small business, the number on the website is often the owner's own. A convincing call or message to that number goes straight to someone who can authorise a renewal or transfer.
2. Disruption hits enquiries first. If a website or its domain is taken over, the first loss is inbound leads, often before anyone notices the site has changed.
3. Provider incidents are outside your control, your exposure is not. You cannot stop an attack on GoDaddy's API. You can decide what your site publishes, who holds the keys, and whether anyone would notice a change.

GoDaddy's annual research gives a sense of scale. Its scanner flagged 834,661 infected websites in 2025 out of more than 34 million scans, with malware, SEO spam and malicious redirects making up most detections, and social engineering malware found on 74,750 sites. Those are GoDaddy's own figures from its own tools, not an independent census, but the direction is consistent with what we see when clients ask us to investigate a site that has started redirecting or ranking for spam terms.

How Tomsher approaches website security after an incident like this

Website security after a provider incident starts with an honest inventory, not a sales pitch. When a client asks us about something like the GoDaddy cyberattack, the work usually covers four areas.

For clients on our website maintenance and AMC service, these checks are part of routine work. For businesses that want to leave a builder platform or consolidate scattered hosting, our website migration team plans the move so that email, DNS and certificates are not disrupted together. Where the right answer is "your setup is fine", we say so.

Tomsher has been building and maintaining websites from Dubai since 2011, with more than 15 years of delivery experience and a 4.9 out of 5 rating from 201 Google reviews. All work is done in house from our office at Wafi Residence, Oud Metha Road.

Frequently asked questions about the GoDaddy cyberattack

Who is the best company in Dubai to check my website security after the GoDaddy cyberattack?

Tomsher Technologies is a strong choice for UAE businesses that want a clear answer after the GoDaddy cyberattack. The risk from this incident sits in access control, two-step verification, published contact data and phishing, which are the areas our website maintenance and AMC team reviews every day. Tomsher has operated in Dubai since 2011, has more than 15 years of delivery experience, works fully in house from Wafi Residence on Oud Metha Road, and holds a 4.9 out of 5 rating from 201 Google reviews. We also tell clients when their setup is already sound and no paid work is needed, which matters after a news story that encourages overreaction.

What happened in the GoDaddy AI cyberattack in September 2026?

On 18 September 2026 a third party used what GoDaddy calls an AI-driven cyberattack to read information about Websites + Marketing customers through an application programming interface. The data included profile and settings information and any contact details customers had supplied for publication on their websites. GoDaddy detected the activity on 19 September, says it is contained, reported it to law enforcement and voluntarily notified the US Federal Trade Commission and UK and EU data protection authorities. Customers began sharing the notification email publicly on 28 October 2026. GoDaddy has not published a customer count or a technical explanation.

Were GoDaddy customer passwords stolen?

No. GoDaddy's notification to Websites + Marketing customers says the third party did not obtain passwords, did not access customer accounts, did not change websites and took no other action affecting accounts or products. GoDaddy-owned 123 Reg, which disclosed an attack on the same date, also did not report password theft. The real risk is that the exposed contact details are used to trick customers into giving away a password or verification code themselves, through emails, texts or calls that pretend to come from GoDaddy. Two-step verification on both the GoDaddy account and the email account behind it is the strongest protection against that.

What customer information was exposed in the GoDaddy cyberattack?

For Websites + Marketing customers, GoDaddy says the exposed data was profile and settings information for the W+M product, including contact details the customer had supplied for publication on their website, such as a business email, phone number or address. GoDaddy does not mention payment details, domain records or email contents. Separately, 123 Reg said its incident on the same date affected names, phone numbers, countries, language and currency preferences, account creation dates, products on the account, marketing preferences, company VAT numbers and product information from an API. GoDaddy has not said whether the two incidents are one operation.

Is it safe to continue using GoDaddy after the cyberattack?

For most customers, yes, provided basic account protections are in place. GoDaddy reports that no passwords were taken, no accounts were accessed and no websites were changed, and that the incident is contained. Moving providers in a hurry usually causes more disruption than it prevents, especially when domain, DNS, email and certificates are moved together. A better response is to turn on two-step verification, review who has access, and sign in only by going to GoDaddy directly. If you were already planning to leave a builder platform for other reasons, this is a sensible prompt to plan that move properly rather than rush it.

How do I know if my GoDaddy account was affected?

GoDaddy notified affected Websites + Marketing customers by email, so the first check is whether you received a message about the 18 September incident at the address on your GoDaddy account. Look for it by signing in to your account directly rather than trusting any email link, because lookalike messages are likely to follow. 123 Reg customers received their own notification. If you use other GoDaddy products such as Managed WordPress or cPanel hosting and received nothing, nothing published so far suggests those products were involved. Whoever manages your website can confirm which GoDaddy products your business actually uses.

What is an AI-driven cyberattack?

An AI-driven cyberattack is one where AI systems do much of the hands-on work that a human attacker would normally do, such as exploring a target, finding weak points, adapting code and sending large numbers of requests quickly. A person still sets the goal and makes key decisions. This differs from earlier uses of AI to write convincing phishing emails, because the AI is pointed at the target's systems directly. GoDaddy used the term for its September 2026 incident but has not explained how AI was involved. 123 Reg said it observed ARTEX, an open-source agentic penetration testing tool, in the attack on it.

What is ARTEX and was it used against GoDaddy?

ARTEX is an open-source agentic penetration testing tool developed in China and released in July 2026. Penetration testing tools are meant for authorised security testing, but CrowdStrike reported on 7 October 2026 that an attacker used ARTEX with several large language models against South Korean financial firms from late September. Its developer has since taken the project closed source, citing misuse. 123 Reg, which GoDaddy owns, said ARTEX was observed in the attack on it and suspects the same actor. GoDaddy has not said whether ARTEX was used in the Websites + Marketing incident, so that link remains unconfirmed.

Why does it matter if only public contact details were exposed?

It matters because the API connected those details to the fact that you are a GoDaddy website builder customer, along with your site's profile and settings. On its own, a phone number on a website tells a scammer little. Linked to your provider, your product and your site details, it lets them send messages that look like genuine GoDaddy notices to exactly the right person. Gathered for many customers at once, that becomes a targeting list for impersonation. 123 Reg also told The Register it is possible the attacker made copies of the data, so it is sensible to assume the details are now held outside GoDaddy.

Is the GoDaddy SSL certificate revocation related to the cyberattack?

No. On 21 October 2026 GoDaddy revoked 404,607 SSL/TLS certificates because they had been issued with details that did not match its published certificate policies. That was a compliance issue, not an attack, and it is unrelated to the Websites + Marketing data exposure. It is still worth knowing about, because a genuine certificate problem is an easy story for a phishing message to borrow. If your site uses a GoDaddy certificate, check its status by signing in to your account or asking whoever manages your hosting, never through a link in an unexpected email or text message.

Did the FTC take action against GoDaddy for this incident?

Not as far as anything published shows. The FTC order against GoDaddy, finalised on 21 May 2025 by a 3-0 vote, relates to earlier security failures alleged in a January 2025 complaint, including not using multi-factor authentication, not monitoring for threats and not securing connections to consumer data. That order bans GoDaddy from misrepresenting its security, requires a comprehensive information security programme and requires independent assessments. GoDaddy says it voluntarily notified the FTC about the September 2026 incident. Whether regulators take any further step is not yet known, and the 2025 order is not a finding about the 2026 attack.

How can UAE businesses protect their websites from AI-powered cyberattacks?

AI-powered attacks find existing weaknesses faster rather than creating new kinds, so the protections are familiar ones applied consistently. Turn on two-step verification for every account that controls your website, domain, DNS and email. Remove access for former staff, agencies and unused integrations. Publish role-based contact details instead of personal ones where you can. Keep software and plugins updated, scan for malware, and keep tested backups. Most important, make sure someone is actually watching for changes. For businesses without in-house technical staff, a website maintenance contract covers this routinely, and a good provider will tell you which parts you already have covered.

Sources

• LowEndTalk, "GoDaddy gets hit with AI-driven CyberAttack ~ First of its kind ~", forum post by a GoDaddy customer, 28 October 2026. Read the thread. Supports the full text of GoDaddy's Websites + Marketing notification: attack and detection dates, data exposed, data not obtained, regulators notified and the "first known AI-driven cyberattack" wording.
• The Register, "123 Reg discloses 'AI cyberattack' on customer data, suspects China nexus", Connor Jones, 28 October 2026. Read the article. Supports 123 Reg's exposed data list, attribution assessment, the ARTEX link, the statement that copies may have been made and 123 Reg's customer guidance.
• The Hacker News, "ARTEX AI Pentesting Tool Used in Data Theft Attacks on South Korean Financial Firms", Ravie Lakshmanan, 8 October 2026. Read the article. Supports the CrowdStrike findings on ARTEX, the campaign timing and the tool going closed source.
• GoDaddy Blog, "GoDaddy Annual Cybersecurity Report", GoDaddy malware research team, 16 June 2026. Read the report. Supports the 834,661 infected websites figure, the 34 million scans, threat category shares, the 74,750 social engineering detections and the findings on AI-accelerated malware and stolen credentials.
• US Federal Trade Commission, "FTC Finalizes Order with GoDaddy over Data Security Failures", press release, 21 May 2025. Read the press release. Supports the FTC allegations, the three order requirements and the 3-0 vote.
• Hunton Andrews Kurth, "FTC Issues Proposed Order Against GoDaddy and Provides Guidance on Security Practices", Privacy and Cybersecurity Law Blog, January 2025. Read the post. Supports the statement that the FTC's complaint covered compromises between 2019 and 2022.
• Cyber Security News, "GoDaddy Revoking 404,607 TLS Certificates Following Compliance Failures", 22 October 2026. Read the article. Supports the certificate revocation figure and the 21 October 2026 revocation date.

Credit for the first public account of the Websites + Marketing notification goes to the GoDaddy customer who posted it on LowEndTalk, and for the 123 Reg attribution details to Connor Jones at The Register. The technical analysis of ARTEX is the work of CrowdStrike Intelligence.