An attacker compromised the domain registration systems for Ghana’s .gh, Sierra Leone’s .sl and American Samoa’s .as, obtaining unauthorized TLS certificates for corresponding domains of services including Google. Google said neither its internal systems nor certificate authorities had been breached. It added the identified certificates to Chrome’s blocklist and requested revocation. The same protection does not automatically extend to other browsers. Official response guidance recommends monitoring certificate transparency logs and configuring CAA, while stressing that CAA alone cannot stop an attacker who controls DNS itself.