THE ARISING · Measurement & AI
Hijacked Country Domains Let Attackers Obtain Fake Security Certificates for Google Sites
Attackers seized DNS control inside Ghana's, Sierra Leone's and American Samoa's domains and got certificates for Google and YouTube addresses. Chrome blocked them, but Google warns it may not have identified every affected domain and that Chrome interventions do not reliably protect other browsers.
The padlock in your browser is supposed to prove you are talking to the real website. Last month, attackers found a way to earn that padlock for Google addresses they did not own. They did it without touching Google at all, by taking over the domain registries one level above.
Google disclosed the incident on October 6, 2026, and The Hacker News reported the details on October 7. Attackers compromised three country-code top-level domain registries:.gh (Ghana),.sl (Sierra Leone) and.as (American Samoa).
They changed authoritative DNS records for selected names. Certificate authorities check DNS to confirm who controls a domain. With the altered records, the attackers passed those checks and obtained valid certificates.
Google said it found no breach of its own systems, and that the certificate authorities did nothing wrong. It blocked the certificates in Chrome and worked with the issuers to revoke them. The announcement does not give a complete certificate count.
Google also said the logs point to other organizations hit by the same attacks, including well-known global brands. It did not name them. It warned that it "cannot guarantee" it found every affected domain, and that Chrome's blocks do not reliably protect people using other browsers.
Google did not name the attackers, explain how the registries were compromised, or say whether any certificate was used to read user data.
Patient portals, telehealth visits, lab results and pharmacy accounts all rest on the same certificate system. That system assumes the domain hierarchy above a website is trustworthy. This incident shows that a weak link high in the chain can undermine every check below it.
The practical risk to most readers is small. The affected names were regional variants, and the certificates are revoked. The structural lesson is larger: health systems and clinics with many domains, including old or regional ones, need to watch them.
• Keep your browser updated; emergency blocks like Google's arrive through updates.
• Reach patient portals and financial accounts through bookmarks or official apps, not links in email or text messages. • If you run a practice or company, monitor certificate transparency logs for all your domains, including parked and country-code ones. • Publish restrictive CAA records, including authorized ACME account bindings where supported, and report unexpected issuance. Google cautions that CAA does not prevent issuance during an active DNS hijack; it helps after control is restored.
Google's October 6 primary incident statement confirms the affected country-code namespaces, DNS changes, unauthorized certificates and mitigations. It does not explain how the registries were compromised or establish whether user data was intercepted.
• Whether the three registries explain the breach and confirm it is closed. • Names of the other affected brands and services. • Faster industry timelines for shortening how long certificate authorities can reuse a domain check.