In a chilling evolution of cybercrime, a new breed of digital theft is targeting high-profile Indian institutions. Attackers are successfully hijacking domain names—the very foundations of an organization’s online identity—without tipping off the victims. By keeping the hijacked domains pointed toward the original, legitimate websites, hackers ensure that business continues as usual, leaving owners completely oblivious to the fact that they have lost control of their digital assets.
This "silent hijacking" has recently ensnared two major Indian entities: the historic Shri Dharmasthala Manjunatheshwara Educational Society and the fertility giant Indira IVF. In both cases, the organizations were only alerted to the breach months later, revealing a systemic vulnerability in how domain registrars and resellers secure customer accounts.
The Anatomy of a Silent Breach
On June 10, 2026, the domain shridharmasthala.org, which serves as the primary hub for accommodation bookings, seva reservations, and online donations for the 800-year-old Shri Dharmasthala temple, was quietly transferred out of its owner’s registrar account. Despite this massive security failure, the website remained functional.
It took eight weeks for the Shri Dharmasthala Manjunatheshwara Educational Society to discover the theft and file a complaint under the Uniform Domain Name Dispute Resolution Policy (UDRP). Subsequent investigations by the Czech Arbitration Court revealed a trail of digital negligence. Logins to the account had been traced to Sweden, Switzerland, and eventually Japan—all occurring months before the final transfer. Crucially, two-factor authentication (2FA) was not enabled on the account, and the email address associated with the account had previously appeared in publicly reported data breaches, leaving the credentials vulnerable to credential stuffing attacks.
This incident mirrors the plight of Indira IVF, India’s largest fertility service provider, which lost its domain indiraivf.com on October 31, 2024. The company did not notice the theft until January 2025. In both instances, the attackers employed a sophisticated deception: they maintained the DNS redirection to the original servers, ensuring that neither the public nor the internal IT teams noticed that the "deed" to the property had been transferred to a third party.
Chronology of Compromise
The Case of Shri Dharmasthala
- Pre-March 2026: The account’s email address is compromised via a public data breach, exposing login credentials.
- March 11, 2026: Initial unauthorized logins begin from overseas IP addresses (Sweden, Switzerland).
- June 10, 2026: The domain
shridharmasthala.orgis fraudulently transferred to a new registrar account. - August 2026: The society discovers the loss and files a UDRP complaint.
- September 14, 2026: The Czech Arbitration Court rules in favor of the society, ordering the return of the domain after acknowledging the society’s common law trademark rights.
The Case of Indira IVF
- August 28, 2024: The domain is renewed for a five-year term.
- October 2024: Unauthorized access is gained to the control panel hosted by Global IT Providers in Jaipur.
- October 31, 2024: The domain is transferred to Hostinger without authorization.
- January 2025: The company discovers the domain is missing from its control panel.
- Post-January 2025: A UDRP complaint is filed. The respondent claims to have bought the domain via a Telegram/Facebook peer-to-peer transaction. The panel rejects this, noting that illegality cannot be the basis for legal rights.
The Legal Mirage: UDRP as a Limited Shield
The UDRP, managed by ICANN, was designed to combat cybersquatting—the act of registering domains in bad faith to extort trademark owners. However, it was never intended to be an incident response tool for security breaches.
To reclaim a domain under UDRP, an organization must clear three high hurdles:
- Identity/Similarity: Proving the domain is confusingly similar to a trademark.
- Lack of Rights: Proving the hijacker has no legitimate interest in the domain.
- Bad Faith: Proving the domain was registered and is being used in bad faith.
While both Shri Dharmasthala and Indira IVF successfully navigated these requirements, the process is inherently flawed for victims of theft. The UDRP process does not investigate how an account was accessed, nor does it hold registrars or resellers accountable for lax security standards. It merely mandates the return of the domain. It does not award damages, identify the specific hacker, or address the systemic failures that allowed the breach to happen in the first place.
The Reseller Gap: A Security Black Hole
The Indira IVF case highlights a particularly dangerous layer in the domain ecosystem: the reseller. When a company manages its domains through a local reseller like "Global IT Providers," they are often one step removed from the security protocols enforced by the parent registrar or ICANN.
There is currently a regulatory vacuum in India regarding the security of these reseller control panels. While the Delhi High Court issued directions in December 2025 requiring e-KYC verification and stricter rules on privacy masking, these mandates focus on who owns a domain, not how a domain is protected from unauthorized access.
There is no federal mandate in India requiring registrars to offer, let alone enforce, two-factor authentication for account access. Furthermore, when a "reseller" is the point of entry, the accountability chain becomes obscured. Are the security standards of a small reseller equivalent to those of a global registrar? The evidence from these two cases suggests they are not.
Implications for Indian Institutions
The fact that these websites remained functional while the domains were hijacked points to a major shift in threat actor strategy. By keeping the site live, hackers avoid the "alarm bells" that go off when a website goes down. This allows them to hold the domain hostage for longer periods, potentially using the hijacked infrastructure to conduct phishing campaigns or intercept high-value traffic—a catastrophic risk for organizations like hospitals and donation-dependent temples.
The Danger of a "Working" Website
The most vital takeaway from these incidents is that a working website is not evidence of security. IT teams often rely on uptime monitors to check if a site is "working." These monitors check if the server responds, not whether the domain management panel has been compromised. Organizations must move beyond uptime monitoring to "DNS integrity monitoring," which alerts administrators the moment a domain’s registrant details or name servers are altered.
Official Responses and Next Steps
MediaNama has reached out to the affected organizations and the service providers involved to understand what internal changes have been implemented to prevent future recurrences.
- To the Complainants: We have asked whether they have conducted forensic audits to determine if the breach extended beyond the domain control panel into their internal databases.
- To the Registrars/Resellers: We have questioned their internal security policies regarding 2FA enforcement and the suspicious nature of the bulk transfers.
- To NIXI and CERT-In: We have inquired about the lack of standardized security protocols for .in domain registrars and whether there is an intent to create a framework for mandatory security hardening of domain management interfaces.
As of this writing, the industry remains largely silent. The legal victories for Shri Dharmasthala and Indira IVF are significant, but they are "band-aid" solutions. Without a fundamental shift in how registrars verify identity and secure administrative access, the next silent hijacking is likely already underway. For any institution that relies on its online presence for revenue or public trust, the lesson is clear: if you are not monitoring your domain registry as closely as you monitor your web server, you are already vulnerable.
