A ransomware group claims it stole data from an AmplifAI workforce platform used by GoDaddy’s call center operations, reportedly exposing employee names, emails, job titles, and login credentials. GoDaddy has not confirmed this incident. Affected workers should change passwords, enable multi-factor authentication, and watch for phishing attempts referencing their employer.
| Company | GoDaddy |
|---|---|
| Industry | Other Commercial |
| Data Types Exposed | Employee Names, Email Addresses, Employee ID Numbers, Account Passwords, Job Titles, Login Activity Records |
| People Affected | 13,565 individuals |
| Attack Method | Ransomware |
| Regulators Notified | Delaware Attorney General |
Were you affected by this breach?
You may be owed compensation.
Data breach victims can recover money for identity-theft losses, out-of-pocket costs, wasted time, and the ongoing risk of fraud — usually with no upfront cost, and no fee unless you win.
Check if you qualify — free reviewWhat Happened in the GoDaddy Data Breach?
A ransomware group has claimed it obtained a large volume of data from an AmplifAI workforce management instance tied to GoDaddy. According to the group’s own leak-site posting, the exposed system managed login credentials, employee rosters, and performance data for GoDaddy’s call center workforce. GoDaddy has not publicly confirmed this incident.
The claim describes a platform used to track agents, managers, and support staff across dozens of internal GoDaddy organizational units. These units reportedly cover sales, commerce, messaging, and customer support programs run both directly by GoDaddy and through third-party staffing partners. Because this report stems from an extortion group’s listing rather than a company statement, the breach discovery date has not been publicly disclosed.
At this stage, there is no confirmed timeline for when unauthorized access may have occurred or how long it may have persisted. The listing includes technical details about login systems and authentication configurations, which suggests the actor had direct access to backend data. However, independent verification of the claim’s full scope has not been established, and GoDaddy’s own investigation findings, if any, are not yet public.
Who was affected?
The leaked dataset reportedly centers on GoDaddy’s outsourced and in-house call center workforce rather than GoDaddy’s retail customers. This means the people most likely affected are current and former employees, contractors, and staff working through third-party vendors who support GoDaddy’s sales and service operations.
The claim references more than 13,000 unique user accounts tied to the platform, though the precise number of individuals actually impacted by any real-world misuse has not been publicly disclosed. In addition, the reported records span multiple countries, including staff locations in the United States, India, and Peru. As a result, the scope of this incident may extend beyond U.S. borders even though GoDaddy itself is a U.S.-based company.
What Information Was Potentially Exposed?
Based on the ransomware group’s own description of the data, the claimed exposure centers on workforce account and operational records rather than customer financial information. The following categories appear in the group’s posted summary of the alleged dataset.
- Employee names and email addresses
- Employee ID and user ID numbers
- Account passwords tied to the workforce platform
- Job titles and manager names
- Work location and assigned program or organization
- Login activity records, including access dates, times, and devices
If accurate, this type of exposure creates meaningful risk even without direct financial data. For example, exposed email addresses paired with job titles and manager names could help attackers craft convincing phishing or business email compromise attempts. Because some accounts reportedly used default or weak passwords, credential-based attacks against related systems are also a realistic concern.
In addition, employee identifiers and login credentials can sometimes be reused across other internal systems. This means a successful compromise of one platform could, in theory, open a path toward broader network access. Affected employees should treat any unexpected login prompts or account alerts with caution until more information becomes available.
What is the company doing?
GoDaddy has not issued a public statement confirming this specific incident, and the available information comes solely from the ransomware group’s own claim. As a result, it is not currently known whether GoDaddy has launched a formal investigation into the AmplifAI platform or verified the authenticity of the leaked data.
However, GoDaddy has a documented history of notifying regulators after confirmed security incidents. For example, the company previously filed a formal notification with the Delaware Attorney General regarding a separate data event. That filing shows GoDaddy follows established breach notification procedures when incidents are confirmed, which may inform how it responds if this claim is verified.
Until GoDaddy issues a statement specific to this AmplifAI-related claim, affected individuals should assume that no official notification or remediation has yet occurred. Anyone concerned about potential exposure should watch for official communication directly from GoDaddy or its outsourcing partners.
What Should Affected Individuals Do?
Change Passwords and Enable Multi-Factor Authentication
If you work or have worked in a GoDaddy-affiliated call center role, consider changing your password for any related work accounts immediately. This is especially important if you suspect you may have used a default or reused password on the affected platform.
In addition, enable multi-factor authentication wherever it is offered. This extra step can prevent attackers from accessing an account even if they obtain a valid password from a leaked dataset.
Monitor for Phishing and Suspicious Communications
Because exposed data reportedly includes names, email addresses, and job titles, phishing attempts could become more convincing. Therefore, be cautious of unexpected emails referencing your manager, program, or work location, even if they appear legitimate.
Never click links or provide credentials in response to unsolicited messages. Instead, verify any unusual request directly through a known, trusted contact method, such as calling your manager or IT department.
Monitor Your Credit Report and Financial Accounts
Although this claim centers on workforce data rather than financial records, it is still wise to monitor your credit report for unusual activity. This is a sound practice anytime personal information may have been exposed in any form.
You can request a free credit report from each major credit bureau once per year. Reviewing these reports regularly can help you catch unauthorized accounts or inquiries early.
Consider Consulting a Data Breach Attorney
If you believe your information was included in this claimed exposure, speaking with a data breach attorney can help clarify your options. An attorney can evaluate whether you may be eligible for compensation if the breach is later confirmed.
Many attorneys offer free initial consultations for potential data breach cases. This means you can learn about your rights without any upfront cost or obligation.
Get a Free Case Review
Tell us how this breach affected you. A data breach attorney will review your situation at no cost and with no obligation — it takes about two minutes.
More Information
Official data breach notification report (PDF) from Delaware Attorney General