Whitearmor leaks GoDaddy AmplifAI data with 13k user records

1. Executive summary

On 2026-11-01 the leak-site operator Whitearmor published an entry claiming a complete data dump from a GoDaddy instance of the AmplifAI workforce platform, hosted at godaddy.ampbi.net and federated to GoDaddy's Okta tenant. The posted material describes 13,565 user records (including 459 admins), 4,451 login-log records, 1,201 roster records and 34 organisations, and lists Okta application identifiers and authentication endpoints. No CVE is associated with this item, no exploitation is recorded in CISA KEV, and no initial access vector, data volume confirmation or victim acknowledgement is stated in public reporting. The listing is an operator claim, not a confirmed breach. For EMEA financial services the direct exposure is low unless a client uses AmplifAI or shares the named business-process outsourcers (Teleperformance, Genpact, SGS) whose staff appear in the data; the material is credential-adjacent and useful for targeted phishing and Okta password-grant abuse against GoDaddy and its suppliers.

2. Regulatory framing

No other article in scope is directly engaged by the facts as reported.

3. Technical analysis & attack chain

The item is a leak-site listing. It establishes an operator claim: Whitearmor asserts it holds a complete dump of a GoDaddy AmplifAI instance and has posted a structured description of the data. It does not establish the access vector, the date or duration of access, the volume actually exfiltrated, or confirmation by GoDaddy or AmplifAI. No source states how initial access was obtained, and no CVE is associated with this item.

The claimed contents, as described in the listing:

1. A user database, all_users.json, of 13,565 unique employees with fields name, email, userseq, firstname, lastname, ad_id, password, aduser, usertype and employeenumber. The listing breaks this down as 6,184 AD (Okta/SSO) users, 16 non-AD local users, 459 admins (type=1), 502 managers (type=2) and 5,239 agents (type=4). It states 13,510 accounts carry a default password and 9 carry non-default passwords. The listing does not show the password values.
2. 34 organisations across four dashboards (Agent Dashboard, Performance Dashboard, Analytics, Non Core Care), including EMEA Brands, Commerce, Global Messaging Ops and US Sales_Support groupings tied to GDDY, TP (Teleperformance), Genpact and SGS.
3. Login logs, login_logs.json, of 4,451 records with fields including Name, Title, Module, Access Date, Access Time, Time Zone, Access Device, Primary Program, Organization, Location, Manager Name and OpsManager Name. Sample locations given are India - Teleperformance, Peru - Teleperformance and USA - GoDaddy; sample devices are Desktop and Mobile.
4. Roster data, roster.json, of 1,201 records (1,193 with @godaddy.com emails), with a companyguid of 51841AF1-EA61-4091-9106-C461ED5293A8 and fields covering employeeid, managerid, location, primaryprogram, title, recorddate and loginuserid.
5. A programs list, programs.json, of 227 GoDaddy call-centre programs spanning Sales, Support, Messaging, Commerce, Geographic, Security and Hosting categories.

The listing also describes the identity integration: Okta tenant https://godaddy.okta.com, the AmplifAI app godaddy_amplifai_1 with App ID exksdlj2ty3Pfq9En0x7, an Office 365 app exk3q5qqbpJoB61dF0x7 federated through the same Okta, SAML 2.0 SSO, an OIDC discovery endpoint, an Authn API at POST https://godaddy.okta.com/api/v1/authn that accepts JSON {username, password} and returns a sessionToken, and support for the password grant (grant_type=password). It states AD identities take the form of a Windows domain login (examples dfolz, axbrown, mgoldstin) and that Okta accepts username, username@godaddy.com and email formats. These are descriptions of a standard Okta deployment, not evidence of a compromise of Okta itself.

The operator provides a Session contact: https://getsession.org, ID 05aef1af8fa855545d00fb4feb9dbef83b658313f06d97ad57736191120a7bf23c.

Adverse Trace assessment: the combination of a user table with a password field, admin counts and a working password-grant endpoint is the material most likely to be reused. If the default-password claim is accurate, credential stuffing and password spraying against godaddy.okta.com and federated Office 365 are the plausible follow-on, but no source shows such activity and this remains an assessment, not a finding. The listing is single-sourced (the operator's own post, mirrored by ransomware.live); nothing here is corroborated by GoDaddy, AmplifAI or an independent researcher.

4. Mitigation & containment

P1 (within 24h)

• If your organisation uses AmplifAI, or contracts Teleperformance, Genpact or SGS on GoDaddy programs, ask the supplier in writing whether your staff or program data sits in the godaddy.ampbi.net instance and whether GoDaddy or AmplifAI has confirmed the claim. No victim confirmation is stated in public reporting.
• Treat any GoDaddy or AmplifAI credentials your staff hold as exposed. Force password resets and revoke active Okta sessions for accounts that authenticate to godaddy.okta.com, and check for the password-grant flow (grant_type=password) being enabled where it is not required.
• Hunt identity logs for authentication to the AmplifAI app (App ID exksdlj2ty3Pfq9En0x7) and the Office 365 app (exk3q5qqbpJoB61dF0x7) from unexpected locations or devices, using the location and device fields the listing says are present in login_logs.json.

P2 (within 72h)

• Enforce phishing-resistant MFA and conditional access on any federated identity provider that fronts workforce platforms; the listing's own description of a JSON username/password Authn API returning a sessionToken is the pattern to close off.
• Brief service-desk and call-centre staff whose names, titles, managers and locations may appear in the roster and login-log data on targeted phishing and vishing that quotes internal org names (EMEA Brands, Commerce, Global Messaging Ops).

P3 (within 7 days)

• Review third-party contracts with outsourced contact-centre providers for breach-notification and data-scope clauses. No fixed release or vendor patch is named in public reporting because this is a data-exposure claim, not a software vulnerability.

5. Indicators of compromise

No atomic indicators of compromise (hashes, malicious domains, IPs, file paths) are available in the source material. The values below are infrastructure named in the operator's post; they are legitimate GoDaddy and Session services, not attacker-controlled malware infrastructure, and are listed for scoping only. Do not block them.

Behavioural indicators

6. Detection

Insufficient indicators to author detection rules. The source material contains no malicious file artefacts, command lines, mutexes, registry keys or distinctive strings belonging to the threat; the Okta endpoints and app IDs are legitimate infrastructure and are not suitable YARA or Sigma content.

7. Sources

• ransomware.live, "Victim: AmplifAI (GoDaddy instance) – Whitearmor", https://www.ransomware.live/id/QW1wbGlmQUkgKEdvRGFkZHkgaW5zdGFuY2UpQFdoaXRlYXJtb3I=, published 2026-11-01.

8. Adverse Trace position

Adverse Trace assesses this as a low-severity item for most EMEA financial services clients: it is a single-source leak-site claim with no confirmed victim acknowledgement, no stated access vector and no CVE, and the named victim is a US web-hosting and domain company, not a financial institution. The material is credential-adjacent (a user table with a password field, admin counts and a password-grant endpoint), so clients that use AmplifAI or share the named outsourcers should treat it as a targeted-phishing and credential-abuse lead rather than a confirmed breach. We will monitor for GoDaddy or AmplifAI confirmation, for any reuse of the dumped identities against godaddy.okta.com, and for further Whitearmor postings naming financial-sector victims, and will reissue if corroboration changes the severity.

Read the original source →

Published via PulseTrace — Adverse Trace threat intelligence.