A national organization with 20 U.S. locations lost access to its primary website and email services after a GoDaddy domain transfer occurred without authorization, according to a report from anchor.host.
The incident, which took following a transfer initiated by an 'Internal User' within GoDaddy, caused all subdomains associated with the parent domain to go dark. The organization, which requested anonymity, had used the domain for 27 years.
According to the report, the transfer took place on a Saturday afternoon. GoDaddy sent an email regarding an account recovery request at 1:39 p.m., and the transfer was completed just four minutes later. The audit log for the account showed the transfer was performed by an 'Internal User' with the status 'Change Validated: No.'
Lee Landis, a partner at Flagstream Technologies, discovered the domain had vanished from his client's account. Despite the account having dual two-factor authentication and 'Full Domain Privacy and Protection' enabled, the transfer proceeded. The transfer also reset the DNS zone to default, wiping the existing DNS zone file and disconnecting all connected services.
Support response delays
Flagstream Technologies staff spent four days attempting to resolve the issue with GoDaddy support. The outlet reported that the process involved 32 calls and 9.6 hours on the phone, with 17 emails sent to the registrar.
Support staff reportedly provided inconsistent instructions. On Sunday, Landis was told to email undo@godaddy.com. By Monday, he was directed to transferdisputes@godaddy.com, and by Tuesday, the instruction changed again to artreview@godaddy.com.
During the initial recovery attempts, tech support agents reportedly told the IT team, “Just wait, we are working on it.” One agent reportedly asked, “Why do you think this is so urgent?”
Landis noted that every escalation attempt generated a new case number, and the different numbers were not linked on GoDaddy's side. The report highlights several specific case numbers, including 01368489 and 01376804.
As of the report, the domain had been moved to another account, but GoDaddy officials could not disclose the new owner due to privacy policies.
