TCS Website Hacked? How a DNS Hijack Took Over tcs.com (2010)

On a Sunday evening in February 2010, visitors to tcs.com, the website of Tata Consultancy Services (TCS), saw a “For Sale” notice claiming the domain was for sale. It looked like the TCS website hacked by intruders, but it was really a DNS hijack. This updated article explains what happened, how DNS hijacking works, and how to protect your own domain today.

Quick answer: The TCS site itself was not broken into. The domain’s DNS records were changed so tcs.com pointed to a different server showing a “domain for sale” page, reportedly through the company’s domain registrar account. The best protection is a strong, unique registrar password, two-step verification, registrar lock and DNSSEC.

What happened when the TCS website was hacked

TCS (external site), part of the Tata Group, is one of India’s largest IT services and consulting companies. When I wrote this on the night it happened, it seemed unbelievable that a top technology company’s site could be taken over so easily.

The details soon became clearer:

• A reader, Aditya, pointed out that it looked like a DNS hack, because the real site still opened through anonymous proxy tools.
• A TCS employee wrote that tcs.com had not been hacked. The DNS records that supply the site’s IP address had been reset to a different IP, while TCS’s internal DNS still showed the correct site.
• MoneyLife reported that the name server records had been re-pointed, possibly by breaking into TCS’s registrar account, perhaps with a compromised password.

Whether it was a hack or social engineering of a change request was never made clear in public reports, so we won’t guess.

Lessons from the TCS website hacked incident

The TCS website hacked story shows that even a big, security-focused company can lose control of its domain through one weak point outside its own servers. Your registrar and DNS accounts are as important as your hosting account. Anyone who can log in to them can effectively take your website and email offline, or redirect them, in minutes.

How DNS hijacking works

Your domain’s DNS records tell the internet which server hosts your website and email. If an attacker gets into your registrar or DNS provider account, they can point the domain anywhere: a fake “for sale” page, a phishing copy of your site, or a server that intercepts email. Your web server is untouched, which is why the TCS site still worked when reached directly.

How to protect your website from a DNS hijack

1. Use a strong, unique password for your domain registrar and DNS provider.
2. Turn on two-step verification for those accounts and for the email address they use. See how to set up Gmail 2-step verification.
3. Enable registrar lock (transfer lock) so the domain can’t be moved without your approval. Ask about registry lock for important domains.
4. Turn on DNSSEC if your registrar and DNS host support it, so resolvers can detect forged DNS answers.
5. Monitor your DNS records and set up alerts for changes.
6. Keep contact details current so renewal and change notices reach you.

For more steps, read our guide to domain name security and stopping domain hijacking. If your site itself is compromised, see how to find malware links on your website.

FAQ

Was the TCS website really hacked?

Reports at the time said the web server was not breached. The domain’s DNS was changed to point to another server.

What is DNS hijacking?

It is when someone changes a domain’s DNS settings without permission so visitors are sent to a different server.

How can I tell if my domain’s DNS has been changed?

Check your records in your registrar or DNS dashboard, and use a DNS lookup tool to see where the domain points from outside your network.

Does DNSSEC stop all domain hijacks?

No. It helps detect forged DNS answers, but if an attacker controls your registrar account, strong passwords, two-step verification and registrar lock matter most.