Across Takes Its Front End and API Offline After Domain Takeover

Across said an attacker used social engineering targeting Namecheap to gain control of its domain, prompting the protocol to suspend its front end and API amid a phishing risk to visitors.

The takeover occurred at about 1:45 p.m. ET (18:45 UTC), and Across said its team received an alert within 15 minutes and took action. SEAL911 flagged across.to as a phishing site, and Cloudflare helped remove the domain’s DNS records. Across said the site is now fully offline and the phishing page cannot be accessed.

Visitors who accessed across.to before Cloudflare removed the records may have been affected. Across said third-party integrations and API users had not been affected by the incident. The company’s own front end and API will remain paused until it resolves the security issue.

Namecheap had not responded at the time of the announcement, leaving Across unable to confirm the domain is secure. Across plans to investigate and publish a postmortem when it has more information.