This is a subdomain takeover.
They typically happen in one of 2 ways:
You have an A record pointing to an IP address that no longer exists and an attacker can gain control of the IP address in question
You have a CNAME record pointing to a domain that no longer exists, and the attacker can register the domain.
The reasons can vary depending on the ...