GoDaddy Inc 8-K, filed Nov 22, 2021
GoDaddy Inc. (GDDY)
8-K
2021-11-22
For: 2021-11-22
View Original
Added on
April 09, 2026
About this 8-K
GoDaddy Inc filed this 8-K on November 22, 2021.
Items reported
- Item 7.01: Regulation FD disclosure
- Item 9.01: Financial statements and exhibits
UNITED STATES
SECURITIES AND EXCHANGE COMMISSION
Washington, D.C. 20549
FORM 8-K
CURRENT REPORT
Pursuant to Section 13 or 15(d) of
The Securities Exchange Act of 1934
Date of Report (Date of earliest event reported)
(Exact name of registrant as specified in its charter)
(State or other jurisdiction of incorporation or organization) | (Commission File Number) | (I.R.S. Employer Identification No.) | |||||||||||||||
(Address of Principal Executive Offices) | (Zip Code) | ||||||||||||||||
(480 ) 505-8800
Registrant's telephone number, including area code
Check the appropriate box below if the Form 8-K filing is intended to simultaneously satisfy the filing obligation of the registrant under any of the following provisions (see General Instruction A.2. below):
Securities registered pursuant to Section 12(b) of the Act:
| Title of each class | Trading Symbol(s) | Name of each exchange on which registered | ||||||||||||
Indicate by check mark whether the registrant is an emerging growth company as defined in Rule 405 of the Securities Act of 1933 (§230.405 of this chapter) or Rule 12b-2 of the Securities Exchange Act of 1934 (§240.12b-2 of this chapter).
Emerging growth company ☐
If an emerging growth company, indicate by check mark if the registrant has elected not to use the extended transition period for complying with any new or revised financial accounting standards provided pursuant to Section 13(a) of the Exchange Act.
¨
Item 7.01 Regulation FD Disclosure
On November 22, 2021, GoDaddy Inc. published a blog post related to its detection of a data security incident. A copy of that blog post is furnished as Exhibit 99.1 to this Current Report on Form 8-K and incorporated herein in its entirety by reference. Such blog post, including any information that is incorporated herein, is being furnished and shall not be deemed “filed” for purposes of Section 18 of the Securities Exchange Act of 1934, as amended (the “Exchange Act”), or otherwise be subject to the liabilities of that section, nor shall it be deemed to be incorporated by reference in any filing under the Securities Act of 1933, as amended, or the rules and regulations of the SEC thereunder, or the Exchange Act or the rules and regulations of the SEC thereunder, except as shall be expressly set forth by specific reference in such filing or document.
Item 9.01 Financial Statements and Exhibits
(d) Exhibits
| Exhibit Number | Exhibit Description | ||||||||||
| 99.1 | |||||||||||
SIGNATURES
Pursuant to the requirements of the Securities Exchange Act of 1934, the registrant has duly caused this report to be signed on its behalf by the undersigned hereunto duly authorized.
| GODADDY INC. | ||||||||
| Date: | November 22, 2021 | /s/ Mark McCaffrey | ||||||
| Mark McCaffrey | ||||||||
| Chief Financial Officer | ||||||||
November 22, 2021
GoDaddy Announces Security Incident Affecting Managed WordPress Service
On November 17, 2021, we discovered unauthorized third-party access to our Managed WordPress hosting environment. Here is the background on what happened and the steps we took, and are taking, in response:
We identified suspicious activity in our Managed WordPress hosting environment and immediately began an investigation with the help of an IT forensics firm and contacted law enforcement. Using a compromised password, an unauthorized third party accessed the provisioning system in our legacy code base for Managed WordPress.
Upon identifying this incident, we immediately blocked the unauthorized third party from our system. Our investigation is ongoing, but we have determined that, beginning on September 6, 2021, the unauthorized third party used the vulnerability to gain access to the following customer information:
•Up to 1.2 million active and inactive Managed WordPress customers had their email address and customer number exposed. The exposure of email addresses presents risk of phishing attacks.
•The original WordPress Admin password that was set at the time of provisioning was exposed. If those credentials were still in use, we reset those passwords.
•For active customers, sFTP and database usernames and passwords were exposed. We reset both passwords.
•For a subset of active customers, the SSL private key was exposed. We are in the process of issuing and installing new certificates for those customers.
Our investigation is ongoing and we are contacting all impacted customers directly with specific details. Customers can also contact us via our help center (https://www.godaddy.com/help) which includes phone numbers based on country.
We are sincerely sorry for this incident and the concern it causes for our customers. We, GoDaddy leadership and employees, take our responsibility to protect our customers’ data very seriously and never want to let them down. We will learn from this incident and are already taking steps to strengthen our provisioning system with additional layers of protection.
Demetrius Comes
Chief Information Security Officer
Forward-Looking Statements
This blog post contains forward-looking statements regarding GoDaddy Inc. (“we,” “GoDaddy,” or the “Company”) which are subject to the safe harbor provisions of the Private Securities Litigation Reform Act of 1995, including our efforts to investigate and remediate the security incident and our attempts to identify and notify affected customers and implement additional security measures. Our forward-looking statements are based on information known to us at the time of this blog post and are subject to a number of known and unknown risks, uncertainties and assumptions that may cause our actual future results, performance, or achievements to differ materially from any future results expressed or implied in this blog post. Factors that contribute to the uncertain nature of our forward-looking statements include, among others, our ongoing investigation of the incident; our vulnerability to additional security incidents; adverse legal, reputational and financial effects on the Company resulting from the incident or
additional security incidents, including regulatory inquiries; and potential operational disruptions as a result of the incident. Because some of these risks and uncertainties cannot be predicted or quantified and some are beyond our control, you should not rely on our forward-looking statements as predictions of future events. Additional risks and uncertainties that could affect GoDaddy’s business and financial results are included in the filings we make with the Securities and Exchange Commission (“SEC”) from time to time, including those described in “Risk Factors” in our Quarterly Report on Form 10-Q for the quarter ended September 30, 2021 as well as those described in “Management’s Discussion and Analysis of Financial Condition and Results of Operations” in our Annual Report on From 10-K for the year ended December 31, 2020 and in our Quarterly Report on Form 10-Q for the quarter ended September 30, 2021, which are available on GoDaddy's website at https://investors.godaddy.net and on the SEC's website at www.sec.gov. Additional information will also be set forth in other filings that GoDaddy makes with the SEC from time to time. All forward-looking statements in this blog post are based on information available to GoDaddy as of the date hereof. GoDaddy does not assume any obligation to update the forward-looking statements provided to reflect events that occur or circumstances that exist after the date on which they were made.