GoDaddy Discloses AI-Driven Cyberattack Incident
The company reported an unauthorized breach of customer contact data that occurred on September 18.
Updated on Oct. 28, 2026 in Cybersecurity
Live Poll
Do you trust that your service providers can keep your personal contact information secure?
GoDaddy experienced its first known AI-driven cyberattack on September 18, which led to the exposure of customer profile, settings, and contact information. The company detected the breach on September 19 and subsequently notified law enforcement along with data protection authorities.
Why it matters
The incident highlights the evolving nature of digital threats as attackers increasingly leverage artificial intelligence to exploit application programming interfaces. While no passwords or account access were compromised, the breach underscores the security risks associated with data stored for website publication.
The attacker successfully obtained information by exploiting an application programming interface to access customer contact details. No customer passwords were stolen, and the unauthorized party did not gain entry into full customer accounts.
The players
GoDaddy
GoDaddy is a publicly traded internet domain registrar and web hosting company that provides services to millions of customers worldwide.
Federal Trade Commission
The Federal Trade Commission is a United States independent agency that protects consumers and promotes competition by preventing anti-competitive and deceptive business practices.
The details
GoDaddy engaged cybersecurity experts and collaborated with industry partners to stop the unauthorized activity. The company confirmed that the attacker did not change any websites and that account-level credentials remained secure.
Timeline
The cyberattack occurred on September 18, 2026.
The breach was detected by the company on September 19, 2026.
The Tech Race
This breach marks a departure from traditional automated attacks, signaling a shift toward more sophisticated AI-driven API exploits. As firms adopt increasingly complex automated infrastructure, the industry faces an arms race to secure entry points against intelligent, adaptive threats.
Customers who have previously supplied contact details for website publication should be aware their information may have been exposed during this incident. Users are encouraged to review their account settings to ensure their information remains current and accurate.
The takeaway
While this breach did not result in the loss of passwords or account control, it serves as a reminder to limit the amount of sensitive personal information shared in public-facing website profiles. Maintaining strict API security and auditing third-party access remains a critical necessity for modern web users and businesses.
Further reading
Learn more about evolving digital threats in our Cybersecurity section.
Source note: This article includes information reported by Vinnews.
Live Poll
Do you trust that your service providers can keep your personal contact information secure?
