# Weak Security Defaults Enabled Squarespace Domains Hijacks

**URL:** <https://onehack.st/t/weak-security-defaults-enabled-squarespace-domains-hijacks/286997>\
**Category:** News & Articles\
**Created:** [July 15, 2024, 7:56pm UTC](https://onehack.st/t/weak-security-defaults-enabled-squarespace-domains-hijacks/286997 "2024-07-15T19:56:51Z")\
**Posts on this page:** 1\
**Page:** 1

<div class="post-metadata">

**Author:** ![TheJoker](https://onehack.st/user_avatar/onehack.st/thejoker/32/22660_2.png) [@TheJoker](https://onehack.st/u/TheJoker)\
**Post date:** [July 15, 2024, 7:56pm UTC](https://onehack.st/t/weak-security-defaults-enabled-squarespace-domains-hijacks/286997/1 "2024-07-15T19:56:51Z")

</div>

**Summary:**

1. **Hijacking Incident** : At least a dozen organizations with domains registered at Squarespace experienced hijacks from July 9 to July 12, primarily targeting cryptocurrency businesses.

2. **Cause of Vulnerability** : The issue arose from weak security defaults during the migration of 10 million domain names from Google Domains, with many customers not having set up their new Squarespace accounts.

3. **Attack Method** : Hackers exploited the ability to commandeer unregistered migrated accounts by providing an email address associated with existing domains, redirecting them to phishing sites to steal cryptocurrency funds.

[Read more on Krebs on Security](https://krebsonsecurity.com)