Attackers took control of the systems behind Ghana’s .gh web addresses and used that control to get real security certificates for Google and YouTube addresses in Ghana. Google says Chrome users are already protected. The bigger lesson of the .gh domain hijack is for anyone who runs a website ending in .gh: for a while, someone else could pretend to be you, and a padlock in the browser would not have given it away.
The short version
Google said on 6 October 2026 that attackers hijacked the registries behind three country web endings, .gh for Ghana, .sl for Sierra Leone and .as for American Samoa, and obtained certificates for Google sites and other organisations. Chrome now blocks those certificates, but owners of .gh sites should check their own records.
- The attackers changed the master address records for .gh, .sl and .as, then used that control to get HTTPS certificates they should never have had.
- Google says its own systems were not breached and that Chrome users do not need to do anything.
- Let’s Encrypt confirmed it issued certificates for Google and YouTube names that have since been revoked.
- Google warns that browser blocks may not catch every affected site and do not protect people on other browsers.
- If you own a .gh domain, check the public certificate logs for your site and add a CAA record that limits who can issue certificates for it.
What happened in the .gh domain hijack?
Every website address ending in .gh depends on one national registry, the central system that tells the internet where each .gh site lives. According to Google’s account of the attack, attackers broke into the third-party systems running the .gh, .sl and .as registries and changed their master address records, known as authoritative DNS records.
That gave them a powerful trick. Certificate authorities, the companies that issue the padlock certificates for websites, check that you control a web address before they issue one. With the registry records in their hands, the attackers passed that check and got real certificates for several Google addresses and for addresses belonging to other organisations. Google says it has no reason to believe the certificate authorities did anything wrong, because they were fooled by the changed records. Let’s Encrypt, one of the companies that issued them, confirmed on its community forum on 7 October that certificates for Google and YouTube names were issued and have been revoked.
Why a stolen certificate is a big deal
The real shift: the padlock in your browser only proves that your connection is encrypted to whoever holds the certificate. If an attacker holds a valid certificate for a real address and can steer your traffic to their server, your browser shows the padlock and the right address while you type your password into their page.
Google has not said whether any of the certificates were used against real people, who the attackers are, or how they got into the registries. It also says its own review may not have found every affected site.
Do ordinary internet users need to do anything?
If you use Chrome, Google says no. Chrome blocks the bad certificates it found through a security list it pushes to every copy of the browser, and Google worked with the certificate authorities to cancel them, which helps people on other browsers too. Still, a few habits protect you from this kind of attack and many others:
- Keep your browser and phone updated, since that is how these blocks reach you.
- Type the address of your bank or a government service yourself instead of tapping a link in a text or email.
- Never click through a browser warning that says a connection is not private on a site where you log in or pay.
- Turn on two-step sign-in for email and banking, so a stolen password alone is not enough. Our 10-minute two-factor guide shows how.
If you run a .gh website, check these four things
- Look up your site in the public certificate logs. Every certificate issued for your address is recorded in public logs called Certificate Transparency. Free search tools such as crt.sh let you type in your address and see every certificate. Look for any recent ones you did not ask for.
- Report anything you did not request to the company that issued it. Under industry rules, the certificate authority must investigate and report back within 24 hours.
- Add a CAA record in your DNS settings. It is a short line that names the only certificate companies allowed to issue for your site. Google recommends tying it to your account with that company. It will not stop an attacker who controls the registry, but it stops them reusing old checks once you are back in control.
- Check parked and old addresses too. Many businesses own a .com.gh address they never use. Attackers like those, because nobody is watching them.
If your business also runs customer logins, remind staff and customers how to spot fake login pages with our phishing email guide.
Who runs .gh now?
Ghana is in the middle of moving .gh away from a private operator. The Ministry of Communication, Digital Technology and Innovations has inaugurated a board for the Ghana Domain Name Registry and charged it with taking full control of .gh from Ghana.com, and the minister, Samuel Nartey George, has called private control of .gh a national security concern. We could not find a public statement about the hijack from the registry or Ghana’s regulators when we checked on 12 October 2026.
What to watch
Three questions are still open: how the attackers got in, whether the .gh, .sl and .as registries are fully secure again, and which other organisations were targeted. Google says it will push for shorter certificate lifetimes and less reuse of old address checks, which would make this kind of attack harder everywhere. Until the registries explain what happened, treat a certificate check on your own .gh site as a five-minute job worth doing this week, and then work through the rest of our account security checklist.
