Researchers: Weak Security Defaults Enabled Squarespace Domains Hijacks
Summary: At least a dozen organizations with domains at Squarespace had their websites hijacked between July 9 and July 12, mostly cryptocurrency businesses including Celer Network, Compound Finance, Pendle Finance and Unstoppable Domains, with some domains redirected to phishing sites built to steal visitors' cryptocurrency funds. Researchers at Metamask and Paradigm attributed the hijacks to Squarespace accounts that had not yet been registered after the Google Domains migration, which attackers could commandeer by entering an email address tied to an existing domain, since no password or email verification was required.
Why it matters: Squarespace bought roughly 10 million domain names from Google Domains in June 2023, and any account whose billing admin had left the company or whose migration email went ignored could be taken over by anyone who typed that email address into the login form.
Read the original at Krebs on Security ↗
- Topics
- Data Breaches
- Related
- TSMC employee data breach linked to cloud provider Cyber Risks · Nov 15, 2026Data Breach at La Poste Subsidiary Maileva Affects 22 Million People in France Cyber Risks · Nov 15, 2026City of Osaka warns of data breach impacting 1 million as Japan reels from dozens of cyber incidents Cyber Risks · Nov 13, 2026