GoDaddy slapped with wet lettuce for years of lax security and 'several major breaches'

The FTC filed a complaint alleging GoDaddy failed to implement basic security controls (asset management, patching, MFA, SIEM, logging, network segmentation, secure connections) across its hosting environment since 2018, citing repeated compromises between 2019 and 2022. A proposed settlement requires GoDaddy to establish a comprehensive security program—including centralized inventory, near-real-time event analysis, audit logging, HTTPS for APIs, and MFA for all relevant access—while prohibiting misrepresentations about security; no immediate fine is imposed, but non-compliance could trigger significant penalties.