Google confirmed that its own systems were not breached, but warned that any domain ending in .gh (Ghana), .sl (Sierra Leone), or .as (American Samoa) was put at risk by the incident. Because the certificates were issued through the hijacked registries, an attacker holding one could impersonate the legitimate site over an encrypted connection, undermining the trust users place in HTTPS.

Key points:

• Three ccTLD registries were hijacked: .gh, .sl, and .as
• Unauthorized HTTPS certificates were issued for multiple Google domains
• Google's internal systems were not compromised
• Any domain under the affected TLDs should be treated as potentially exposed

For defenders and domain owners, this serves as a reminder that certificate issuance depends on the integrity of the registry chain, and that compromise at the registry level can have downstream effects well beyond a single organization.

Source: info@thehackernews.com (The Hacker News)
If your organization owns domains under .gh, .sl, or .as, have you reviewed your certificate logs or reached out to your registrar yet?