Google said attackers compromised the registries for three country-code top-level domains, .gh, .sl and .as, and used that access to obtain unauthorized HTTPS certificates for several Google domains. According to Google, its own systems were not breached, but the incident created a trust problem at the domain and certificate layer.

For businesses, the case is a reminder that website security does not depend only on internal infrastructure. Trust in a website also relies on external parties such as domain registries, DNS providers and certificate authorities.

What happened

According to Google, attackers gained control of the registries for .gh, .sl and .as. With that access, they were able to obtain unauthorized HTTPS certificates for some Google domains under those country-code extensions.

An HTTPS certificate is used to prove that a website is legitimate and to encrypt traffic between the site and its visitors. If an attacker can obtain a valid-looking certificate for a domain, they may be able to impersonate that site in certain scenarios, including interception or phishing-style attacks that appear more trustworthy to users.

Based on the information provided, Google said its internal systems were not breached. The exposure instead affected trust in domains ending in .gh, .sl and .as.

Why it matters for European businesses

Many European companies operate internationally and may use country-code domains for local markets, defensive registrations or brand protection. This incident shows that a weakness at the registry level can affect HTTPS trust even when a company’s own servers, applications and cloud environment remain secure.

The practical business risk is not limited to large technology companies. If attackers can obtain unauthorized certificates for a domain, they may be able to make fake sites look legitimate, increase the credibility of phishing campaigns, or undermine confidence in regional web properties.

This is especially relevant for businesses that:

• use country-code domains for international websites or local campaigns
• depend on domain-based trust for e-commerce, customer portals or email authentication
• serve customers in markets where local domains are part of brand strategy
• have limited visibility into certificate issuance and external DNS or registry risks

For regulated sectors, the incident also reinforces a supply-chain view of cybersecurity. External infrastructure providers can create exposure even when core systems are well managed internally.

Who may be affected

• Companies using .gh, .sl or .as domains for websites, landing pages, regional brands or redirects
• Multinational SMEs and e-commerce businesses running localized web properties under country-code domains
• IT and security teams responsible for DNS, certificate monitoring and domain governance
• Marketing teams and agencies managing campaign microsites or regional domains outside central IT controls
• Regulated businesses that need stronger oversight of third-party digital infrastructure and trust chains

What companies should consider

• Review domain inventory: confirm whether your business owns or relies on domains under affected country-code extensions, including parked and campaign domains.
• Monitor certificate issuance: use certificate transparency monitoring or similar services to detect unexpected certificates issued for your domains.
• Tighten domain governance: make sure domain registration, DNS management and certificate processes are centrally tracked rather than spread across teams or agencies.
• Assess third-party dependencies: include registries, registrars, DNS providers and certificate-related services in your security risk reviews.
• Prepare incident response steps: define how your team would respond if an unauthorized certificate or suspicious domain change is detected.
• Check customer-facing trust signals: where appropriate, strengthen anti-phishing measures and customer communications, especially if your brand operates across multiple local domains.

Although the reported incident involved specific country-code registries and Google domains, the broader lesson is more widely applicable: website trust depends on the security of the entire domain and certificate ecosystem, not only on the business’s own network and applications.