At least 195 web addresses belonging to Donald Trump, his family or his business empire were hijacked by hackers possibly operating out of Russia, the Associated Press has learned.
The incident happened four years ago, well before the furore over allegations that Moscow meddled in the 2016 election that put Mr Trump in the White House.
The Trump Organisation denied the domain names were compromised, but a review of internet records by the AP and cybersecurity experts shows otherwise, and it was not until this past week, after the Trump camp was asked about it by the AP, that the last of the tampered-with addresses were repaired.
After the hack, computer users who visited the Trump-related addresses were unwittingly redirected to servers in St Petersburg that cybersecurity experts said contained malicious software commonly used to steal passwords or hold files for ransom. Whether anyone fell victim to such tactics is unclear.
A further mystery is who the hackers were and why they did it.
The discovery represents a new twist in the Russian hacking story, which up to now has focused mostly on what US intelligence officials say was a campaign by the Kremlin to try to undermine Democrat Hillary Clinton's candidacy and benefit Mr Trump's.
It is not known whether the hackers who tampered with the Trump addresses are the same ones who stole Democratic officials' emails and embarrassed the party in the heat of the campaign last year. Nor is it clear whether the hackers were acting on behalf of the Russian government.
The affected addresses, or domain names, included donaldtrump.org, donaldtrumpexecutiveoffice.com, donaldtrumprealty.com and barrontrump.com.
They were compromised in two waves of attacks in August and September 2013, according to the review of internet records.
The attacks took place as Mr Trump was preparing to travel to Moscow for the Miss Universe pageant, which was held on November 9 2013 at a property owned by a wealthy Russian real estate developer.
Many of the addresses were not being used by Mr Trump. Businesses and public figures commonly buy addresses for possible future use or to prevent them from falling into the hands of rivals or enemies. The Trump Organisation and its affiliates own at least 3,300.
According to security experts, the hackers hijacked the addresses by penetrating and altering the domain registration records housed at GoDaddy.com, a seller of web addresses.
Accounts at GoDaddy, like at any site that requires a user name and password, are often subject to malicious messages known as phishing attacks, which are designed to trick people into revealing that personal information to hackers.
Within days of the AP asking the Trump Organisation about the tampering, the affected web addresses were all corrected.