Skip to content
Ransomware News

AmplifAI (GoDaddy instance) Data Breach: Whitearmor Ransomware Claim (Nov 2026)

Admin
HookPhish team

Summary

In the latest cybersecurity news, AmplifAI (GoDaddy instance) — an organization based in US — has fallen victim to a ransomware attack conducted by the group Whitearmor. This data breach, discovered on 2026-11-01T13:58:21.336343+00:00, underscores the increasing need for proactive cybersecurity defenses as we continue through 2026.

Incident Report

Attribute Information
Target Organization AmplifAI (GoDaddy instance)
Threat Group Whitearmor
Summary GoDaddy AmplifAI Instance — Complete Data Dump
================================================

URL: https://godaddy.ampbi.net
Okta SSO: https://godaddy.okta.com
Okta App ID: exksdlj2ty3Pfq9En0x7 (AmplifAI)
Office 365 Federation: godaddy.okta.com/app/office365/exk3q5qqbpJoB61dF0x7

============================================================
USER DATABASE — 13,565 unique employees
============================================================

File: all_users.json
Fields per user:
“name”: “”,
“email”: “”,
“userseq”: ,
“firstname”: “”,
“lastname”: “”,
“ad_id”: “”,
“password”: “”,
“aduser”: “true/false”,
“usertype”: “1/2/3/4”,
“employeenumber”: “”

User Type Key:
1 = Admin
2 = Manager
4 = Agent

Breakdown:
Total users: 13,565
AD users (Okta/SSO): 6,184
Non-AD users (local): 16
Admins (type=1): 459
Managers (type=2): 502
Agents (type=4): 5,239
Default password: 13,510
Non-default passwords: 9

============================================================
ORGANIZATIONS — 34 total
============================================================

1. Agent Dashboard – Organizations
1. DEM Sales_Support – ALL
2. DEM Sales_Support – GDDY
3. DEM Sales_Support – TP
4. GD International Independents
5. GD US Independents
6. Commerce – GDDY
7. Commerce – TP
8. DEM Sales_Support – SGS
9. EMEA Brands – ALL
10. EMEA Brands – GDDY
11. EMEA Brands – TP
12. GAO – GDDY
13. GD Teleperformance
14. Global Messaging Ops – GDDY
15. Global Messaging Ops – Genpact
16. Global Messaging Ops – SGS
17. Global Messaging Ops – TP

2. Performance Dashboard – Organizations
18. ROW Sales_Support – ALL
19. ROW Sales_Support – Genpact
20. ROW Sales_Support – SGS
21. Services – SGS
22. US Sales_Support – SGS

3. Analytics – Organizations
23. Global Messaging Ops – ALL
24. ROW Sales_Support – TP
25. Services – ALL
26. Services – GDDY
27. Services – TP
28. US Sales_Support – ALL
29. US Sales_Support – GDDY

4. Non Core Care – Organizations
30. US Sales_Support – TP
31. Non Core Care – GDDY
32. Non Core Care – Genpact
33. Non Core Care – SGS
34. Non Core Care – TP

============================================================
LOGIN LOGS — 4,451 records
============================================================

File: login_logs.json
Fields per record:
“Name”: “”,
“Title”: “”,
“Module”: “”,
“Access Date”: “”,
“Access Time”: “”,
“Time Zone”: “”,
“Access Device”: “”,
“Primary Program”: “”,
“Organization”: “”,
“Location”: “”,
“Manager Name”: “”,
“OpsManager Name”: “”

Sample locations: India – Teleperformance, Peru – Teleperformance, USA – GoDaddy
Sample devices: Desktop, Mobile

============================================================
ROSTER DATA — 1,201 records (1,193 with @godaddy.com emails)
============================================================

File: roster.json
Fields per record:
“RosterExportID”: “”,
“companyguid”: “51841AF1-EA61-4091-9106-C461ED5293A8”,
“employeeid”: “”,
“email”: “”,
“fname”: “”,
“lname”: “”,
“managerid”: “”,
“pbxid”: null,
“location”: “”,
“primaryprogram”: “”,
“title”: “”,
“recorddate”: “”,
“hiredate”: null,
“termdate”: null,
“loginuserid”: “”,
“customfield1”: null,
“customfield2”: null,
“customfield3”: null,
“customfield4”: null,
“customfield5”: null,
“customfield6”: null,
“customfield7”: null,
“customfield8”: null,
“customfield9”: null,
“customfield10”: null,
“otherprogram1”: null,
“otherprogram2”: null,
“otherprogram3”: null,
“otherprogram4”: null,
“otherprogram5”: null,
“otherprogram6”: null,
“otherprogram7”: null,
“otherprogram8”: null,
“otherprogram9”: null,
“otherprogram10”: null,
“varcharemployeeid”: “”,
“varcharmanagerid”: “”,
“organization”: “”,
“movedToCosmos”: “False”,
“glidepathtitle”: null,
“gltitleid”: null,
“coach”: null,
“programstartdate”: null,
“RequestID”: “”

Roster by Organization:
US Sales_Support – GDDY: 405 records
Global Messaging Ops – Genpact: 191 records
EMEA Brands – GDDY: 176 records
Commerce – GDDY: 135 records
DEM Sales_Support – GDDY: 103 records
ROW Sales_Support – SGS: 101 records
Commerce – TP: 41 records
Non Core Care – Genpact: 37 records
Services – TP: 12 records
—————————————-
TOTAL: 1,201 records

25 organizations have no roster data available.

============================================================
PROGRAMS — 227 unique GoDaddy call center programs
============================================================

File: programs.json

Categories include:
Sales: Inbound Sales I/II/III, Email Sales, Outbound Sales, Specialty Sales
Support: C3 Support (English/German/Spanish/Arabic/Turkish/Cantonese/Mandarin)
Messaging: General, Hosting, Email, Sales, Arabic, Cantonese, Mandarin, Spanish, India, RoW
Commerce: Commerce Inbound, Commerce Outbound, Commerce Sls PS
Geographic: UK & IE, CA & AU, LATAM, EMEA, International English
Security: Website Security Sales I/II, Website Security Support
Hosting: Hosting Support Web Pro, Server Admin Support, Tech Services

============================================================
OKTA / ACTIVE DIRECTORY INTEGRATION
============================================================

Okta Tenant: https://godaddy.okta.com
AmplifAI App: godaddy_amplifai_1 (exksdlj2ty3Pfq9En0x7)
Office 365 App: exk3q5qqbpJoB61dF0x7 (federated via same Okta)
SAML SSO: SAML 2.0
OIDC Discovery: https://godaddy.okta.com/.well-known/openid-configuration
Authn API: POST https://godaddy.okta.com/api/v1/authn
(accepts JSON {username, password}, returns sessionToken on success)
Password Grant: Supported (grant_type=password in OIDC config)

AD User Identity Format:
“Login/AD/NT Id” field = Windows domain login (e.g., dfolz, axbrown, mgoldstin)
Okta accepts: username, [email protected], EMAIL format

Reach out on session or be the next headline
https://getsession.org
ID: 05aef1af8fa855545d00fb4feb9dbef83b658313f06d97ad57736191120a7bf23c

Date of Breach 2026-11-01T13:03:00+00:00
Discovery Date 2026-11-01T13:58:21.336343+00:00
Region US
Business Sector Technology

 

How to reduce your ransomware risk

Most ransomware intrusions start with a stolen password or a phishing email. A few proactive steps sharply cut your exposure:

Want to know if you’re already exposed? Run a free scan with the HookPhish data breach checker.

Disclaimer

HookPhish does not engage in the exfiltration, downloading, taking, hosting, viewing, reposting, or disclosure of any stolen information. All breach data reported here is sourced from publicly available threat intelligence feeds for awareness purposes only.

Related articles

Security training designed for people.

See how HookPhish turns phishing simulation, training and threat monitoring into measurable human-risk reduction.

Book a demo Explore solutions