Summary
Hackers have hijacked Google domain registrations in multiple countries by breaching the country-code top-level domain (ccTLD) registries that manage national internet namespaces. By compromising the registry infrastructure rather than Google’s own systems, attackers were able to modify DNS records for Google’s country-specific domains at the authoritative source, redirecting traffic intended for Google services to attacker-controlled infrastructure. The attack demonstrates that registry-level compromise represents a class of DNS hijacking that bypasses domain owner security controls entirely, as the attack occurs above the level at which domain owners have any authority or visibility.
Timeline
| Date | Event |
|---|---|
| Oct 8, 2026 | Hackers breach ccTLD registries in multiple countries; Google domain registrations hijacked; Google services disrupted in affected regions; BleepingComputer reports |
What Happened
Country-code TLD registries are the authoritative DNS operators for national internet namespaces — the .uk registry controls all .uk domains, the .de registry controls all .de domains, and so on. When a ccTLD registry is compromised, the attacker gains the ability to modify DNS records for any domain in that namespace, regardless of what security controls the domain owner has implemented. Google operates country-specific domains in dozens of countries (google.co.uk, google.de, google.fr, etc.) and these domains are subject to the authority of their respective ccTLD registries.
The attack is significant because it represents a supply chain attack on internet infrastructure that is largely outside the control of domain owners. An organization can implement DNSSEC, two-factor authentication on their registrar account, registry lock, and every available domain security control — and still be vulnerable to hijacking if the ccTLD registry that holds their domain is breached. The attack also demonstrates that even the world’s most security-conscious organizations, operating domains with the highest available security configurations, cannot protect against registry-level compromise. The affected ccTLD registries have not been publicly named.
Domain Intelligence
google.com — 52.32
google.com scores in the low-trust range at 52.32 with a T6_CREDIBLE_SINGLE_SOURCE:virustotal flag — a confirmed credible intelligence source observation, distinct from the unconfirmed single-source flags that appear on many domains in this score range. Google is the victim organization whose country-specific domain registrations were hijacked through ccTLD registry compromise.