GoDaddy announced on Monday a security breach that could affect up to 1.2 million customers, exposing their e-mail addresses and customer numbers.

The exposure of email addresses presents a risk of phishing attacks, a scheme in which a hacker sends a target an e-mail and tricks them into sending over sensitive information by clicking a link that deploys malicious software.

The breach was discovered last week on Nov. 17 when GoDaddy found an unauthorized third-party was accessing their Managed WordPress hosting environment. WordPress is a free and open-source content management system that allows users to create a website easily. 

They identified suspicious activity in their Managed WordPress hosting environment and immediately began an investigation and contacted law enforcement. Using a compromised password, the unauthorized third party was able to access their code since Sep. 6.

Information such as WordPress Admin passwords, database usernames and passwords, SSL private keys and more were exposed.

GoDaddy has reset WordPress admin passwords used at the time of the breach as well as sFTP and database passwords. The company is also in the process of issuing and installing new certificates for a subset of active customers whose SSL private keys were exposed.

“Our investigation is ongoing and we are contacting all impacted customers directly with specific details. Customers can also contact us via our help center (https://www.godaddy.com/help) which includes phone numbers based on country,” Comes wrote.

“We are sincerely sorry for this incident and the concern it causes for our customers. We, GoDaddy leadership and employees, take our responsibility to protect our customers’ data very seriously and never want to let them down. We will learn from this incident and are already taking steps to strengthen our provisioning system with additional layers of protection.”

A few weeks ago, Robinhood said that it suffered a security breach where hackers accessed some personal information for a total of 7 million Robinhood customers and demanded a ransom payment, according to The Associated Press.

In August, a T-Mobile data breach reportedly affected 100 million of its wireless customers.

This is not the first time that GoDaddy has been impacted by a data breach. Last year, the company had confirmed that thousands of its web hosting accounts were breached by an unauthorised individual exposing web hosting account credentials.

It is important that we always have to be ready for any kind of new attacks in future, Always have your daily backup to an external storage or local.