A leading website hosting provider serving approximately five million customers, GoDaddy,has come under scrutiny from the Federal Trade Commission (FTC) for failing to secure its services over a prolonged period adequately. In a formal complaint, the FTC alleged that GoDaddy’s insufficient cybersecurity practices led to multiple breaches between 2019 and 2022, exposing customer websites and data to unauthorized access.
Despite the gravity of the allegations, GoDaddy has avoided monetary penalties. Instead, the company has agreed to implement a robust information security programme as part of a proposed settlement order, prohibiting it from misrepresenting its security and compliance practices.
The FTC’s complaint detailed significant shortcomings in GoDaddy’s cybersecurity framework, including a failure to inventory its assets, inconsistent patch management, weak authentication methods, insufficient network segmentation, and delayed adoption of critical security tools such as multifactor authentication (MFA) and endpoint detection systems.
By September 2020, GoDaddy reportedly had visibility into only 15,000 devices out of an eventual inventory of 450,000. This lack of oversight, compounded by poor API security and inadequate threat monitoring, left its customers vulnerable to cyberattacks.
GoDaddy must establish a comprehensive information security program as part of the settlement. Key requirements include appointing dedicated personnel to oversee security measures, implementing a Security Information and Event Management (SIEM) tool or equivalent, maintaining robust system audit logs, and adopting at least one multifactor authentication method. The company must also encrypt sensitive data, secure remote access, and enhance its authentication protocols to bolster cybersecurity.
Additionally, GoDaddy must undergo independent audits of its security programme, with reviews conducted initially and biennially. Noncompliance with the order could result in civil penalties of up to US$51,744 per violation.
The FTC emphasized the importance of carefully evaluating web hosting providers’ security practices. It advised businesses to inquire about essential security aspects, such as the technologies used to protect websites, data storage locations, the availability of multifactor authentication, and contact protocols for reporting suspicious activity. The commission also highlighted websites’ critical role as virtual storefronts and repositories of sensitive data, underscoring the non-negotiable need for strong security measures.
A GoDaddy spokesperson noted that the company has already implemented several of the FTC’s mandated measures and continues to enhance its security infrastructure. While GoDaddy did not admit or deny the allegations, it expects the settlement to have minimal financial impact.
