3 Registries Hacked to Steal Google Certs, Though Core Infrastructure Remains Secure

Attackers successfully obtained unauthorized HTTPS certificates for multiple Google domains by exploiting compromised country-code top-level domain (ccTLD) registries. According to a report by The Hacker News, Google disclosed the incident on October 6, stating that while its own systems were not breached, the compromise of third-party registry operators allowed the issuance of fraudulent certificates.

The risk

The security incident involved the hijacking of authoritative DNS records within three specific ccTLDs: .gh for Ghana, .sl for Sierra Leone, and .as for American Samoa. BleepingComputer reported that hackers breached the third-party operators managing these registries, modifying DNS records to facilitate the unauthorized certificate issuance.

With a valid HTTPS certificate for a Google domain, an attacker could impersonate the legitimate site over an encrypted connection. This capability enables man-in-the-middle attacks where users believe they are communicating with a genuine Google service, while traffic is actually being intercepted or redirected by the threat actors. The integrity of the transport layer security relies heavily on the trust chain anchored by these registries; when that chain is broken at the registration level, encryption alone cannot prevent fraud.

Who is exposed

According to The Hacker News, any domain ending in .gh, .sl, or .as was put at risk by this compromise. The exposure extends to organizations and users relying on these specific country-code domains for Google services or other web infrastructure. While the immediate reports highlight Google domains as a target for the fraudulent certificates, the underlying vulnerability in the registry operators affects the broader ecosystem of websites hosted under these ccTLDs.

Cost and compliance

The source material does not provide specific data regarding financial damages, the number of unique certificates issued, or regulatory penalties associated with this incident. Google’s statement focused on the technical scope, confirming that its core infrastructure was safe from direct intrusion.

What should you do?

Security teams should immediately audit their certificate inventory for any domains registered under .gh, .sl, or .as. Verify the integrity of your DNS configurations and monitor for unexpected changes in authoritative records. Ensure that security tools are configured to alert on certificate transparency logs for these specific top-level domains.

Background: HTTPS

HTTPS encrypts traffic between browsers and servers, preventing eavesdropping and tampering. It does not protect against server-side breaches, malware on your device, or poor application security. Use it for all public traffic, but pair it with secure software development practices to address its blind spots.

Read the full guide: HTTPS Limits: What Encryption Cannot Protect in Your Stack

What to do and how to stay safe: Google

• Monitor Certificate Transparency (CT) logs for new certificate issuances associated with .gh, .sl, and .as domains to detect potential fraud early.
• Validate the certificate chain for any critical services using these ccTLDs, ensuring the issuing Certificate Authority is trusted and the domain ownership is verified.
• Implement strict DNS security extensions (DNSSEC) where possible to add a layer of authentication to DNS responses and mitigate hijacking risks.
• Review access controls for third-party DNS and registry management platforms to ensure strong authentication and least-privilege principles are enforced.

Step-by-step guide: Phishing Warning Signs: Spotting Attacks Before You Click

General security guidance from the Vector Tribune newsroom. It is not confirmed advice from the organisations named in this story.

Frequently asked questions

Did attackers breach Google's internal servers?

No, Google confirmed that its own systems were not breached; the attack targeted the third-party operators of the .gh, .sl, and .as registries.

Which country-code top-level domains were compromised?

The compromised registries were .gh (Ghana), .sl (Sierra Leone), and .as (American Samoa).

What was the primary impact of this incident?

Attackers were able to obtain unauthorized HTTPS certificates for several Google domains, potentially allowing them to impersonate these sites over encrypted connections.