Hackers broke into the domain registries of Ghana, Sierra Leone and American Samoa and used the access to obtain fake TLS certificates for Google domains, Ars Technica reported.

The attackers changed DNS records for the country-code domains and passed the automated checks that certificate authorities use before issuing certificates. With the fake certificates, they could impersonate websites, intercept traffic and run convincing phishing attacks.

Google discovered the breach through Certificate Transparency data. It blocked the rogue certificates in Chrome and worked with certificate authorities to revoke them.

Other large services were also affected, according to the reports. Google said its own systems were not breached.

The incident shows how fragile the internet’s trust system can be. A single registry compromise can put millions of users at risk.

Security experts advise users to keep browsers updated. Google says there is no evidence the certificates were widely abused.

The affected country-code domains serve millions of websites. Registry operators say they have locked down their systems since the breach.