What Happened
Attackers compromised third-party operators for the Ghana (.gh), Sierra Leone (.sl), and American Samoa (.as) country-code domains. BleepingComputer reports they changed authoritative DNS records, passed certificate authority domain validation, and obtained valid HTTPS certificates for Google domains.
Google says its own systems were not breached and sees no sign the issuing authorities acted improperly. Chrome blocked the certificates through CRLSets, and Google worked with the authorities to revoke them. A review of Certificate Transparency logs exposed more affected organizations, including several major global brands. Google notified them where possible. Google does not guarantee it found every domain, and CRLSets do not protect non-Chrome users reliably.
Why This Matters for Canadian Organizations
The reports name only .gh, .sl, and .as. None mentions .ca. The lesson still applies to Canadian organizations. Banks, retailers, and public bodies hold brand domains across many registries, often parked and unwatched. A valid certificate on an unwatched domain gives an attacker a convincing phishing site or a path to intercept traffic.
The attack also moves the weak point outside your network. You control your DNS settings and your certificate requests, yet a compromised registry operator overrides both. Federally regulated institutions should treat this as a third-party risk under OSFI Guideline B-13. Privacy teams should note a hijacked domain used to collect customer data creates PIPEDA exposure.
What to Do
List every domain your organization owns, including parked and foreign-registry names. Monitor Certificate Transparency logs across the whole portfolio and alert on any unexpected issuance. Publish restrictive CAA records which limit issuance to your authorized ACME accounts and validation methods. CAA does not stop issuance during an active hijack, but it blocks reuse of cached validation after you regain DNS control. Review which registries and DNS operators you depend on. Our Trends coverage and daily briefs track related stories.
