Website performance monitoring firm DebugBear says attackers compromised its DNS server records through its domain registrar. The company reported that it could not receive e-mail sent to its domain while the investigation was running.
The incident is linked to the supply-chain attack on the prediction market Polymarket at the end of October. Malicious JavaScript was served from a DebugBear address that Polymarket's site loaded. DebugBear's real user monitoring (RUM) script was the vector, and DebugBear initially told customers to remove the embed code.
In its first findings, DebugBear wrote: "Our DNS server records were compromised through our domain registrar." It said the attackers appear to have targeted one customer's website specifically, a preliminary finding. It has not explained how the attackers got access at registrar level, and it found no sign that its internal systems were compromised. Neither DebugBear nor Polymarket has named the registrar.
For domain holders the case shows the risk of registrar account access: whoever controls the registrar login can change DNS records and redirect a site without touching the hosting server. Account protection (strong and unique passwords, two-factor authentication, lock on transfers and DNS changes) is the main safeguard.
Sources: SecurityWeek, 2 November 2026