GoDaddy emailed employees that they got a USD 650 bonus – but it turned out to be an evil trick

GoDaddy, the world’s largest domain registrar, has come under the spotlight recently but for the wrong reasons. On 14 December, the US company sent its employees an email that thanked them for their hard work and as a reward, they are to receive a holiday bonus of USD 650 (RM2,635).

But two days later, about 500 employees of the web hosting company were informed that they have failed a phishing test, and they would need to take a training course on social engineering.

For those not familiar, the technique of phishing is widely used by hackers to obtain information or infiltrate a company’s network by passing off as a trusted source to gain access to sensitive information like usernames and passwords.

Now, the practice of conducting phishing tests on employees is nothing new. Companies usually employ cybersecurity companies to conduct such tests to gauge how susceptible their employees are to these attacks. But the timing of this test and the sensitive nature of the subject, made this act unacceptable even if there wasn’t a global pandemic.

It should be noted that the Scottsdale-based company had every reason to beef up their cybersecurity. Forbes reported that GoDaddy suffered a data breach earlier this year that impacted 28,000 employees, compromising their usernames and password.

GoDaddy has since apologised after the email incident. It issued a statement to the AFP saying:

GoDaddy takes the security of our platform extremely seriously. We understand some employees were upset by the phishing attempt and felt it was insensitive, for which we have apologized.

While the test mimicked real attempts in play today, we need to do better and be more sensitive to our employees.

As it turns out, GoDaddy isn’t the only company this year to trick its employees by dangling a potential bonus. In September, Tribune Publishing sent an email telling employees they would get targeted bonuses between USD 5,000 (RM20,268) to USD 10,000 (RM40,535). It was later revealed as a phishing test sent by the company. This exercise also drew a lot of fury from employees with many airing their dissatisfaction on Twitter.

So, what do you think? How would you have reacted or responded if your employer carried such a test on your company? Is there a better way to educate employees on the dangers of phishing without making them feel like fools? Let us know your thoughts in the comments section below.

[SOURCE, 2]

Related reading