By Legal & Technology Desk

In the modern digital landscape, visibility is often mistaken for security. For many organizations, the simple fact that their website continues to load smoothly, process payments, and field customer inquiries is assumed to be proof that their digital infrastructure remains safely in their hands.

However, recent international arbitration decisions involving two prominent Indian entities—the historic Shri Dharmasthala temple and fertility giant Indira IVF—have shattered this complacent assumption. In both cases, high-value domain names were covertly transferred out of the owners’ control accounts without their immediate knowledge. Most deceptively, the websites kept functioning normally, masking a silent digital takeover that left the actual owners blind to the breach for months.

To recover their digital assets, both organizations were forced to bypass domestic legal avenues and turn to the international Uniform Domain Name Dispute Resolution Policy (UDRP). These cases expose a startling regulatory and security blind spot in how domain registrars and resellers protect institutional assets, highlighting an urgent need for structural reform across the digital supply chain.

1. The Anatomy of Stealth: Main Facts of the Incidents

Domain hijacking has traditionally been associated with overt vandalism, ransom demands, or malicious redirection to spam and phishing sites. However, sophisticated cybercriminals are shifting toward a subtler playbook: silent misappropriation.

In both the Shri Dharmasthala and Indira IVF incidents, the bad actors executed a precise maneuver. They penetrated the victim’s domain registrar or reseller accounts, authorized a transfer of the domain to a new registrar, and immediately pointed the domain back to the original website.

Because the web servers continued to serve the original content, standard monitoring tools failed to sound an alarm. Customers booking temple sevas or patients scheduling fertility consultations experienced zero downtime or unusual redirects.

The Shri Dharmasthala Breach

On June 10, 2026, the domain shridharmasthala.org—which handles online accommodation bookings, donations, and religious services for the 800-year-old Karnataka temple—was quietly transferred out of its owner’s registrar account.

According to post-incident disclosures by the registrar to the Czech Arbitration Court, the account had experienced suspicious foreign logins originating from Sweden, Switzerland, and, post-transfer, Japan, dating as far back as March 11, 2026. Two-factor authentication (2FA) was disabled on the account at the time of the breach, and the associated email address had previously appeared in publicly reported data breaches, indicating prior credential exposure.

The Indira IVF Breach

A nearly identical blueprint was utilized against Indira IVF Hospital Private Limited. The company lost control of indiraivf.com on October 31, 2024. The theft went completely unnoticed for months until January 2025, when administrators discovered the domain was missing from their control panel.

The company’s domain service provider, Jaipur-based Global IT Providers, revealed that the control panel had been accessed from an unfamiliar location in October 2024. While a notification email about the transfer was theoretically sent, it was buried under the massive volume of daily administrative emails received by the hospital chain.

2. A Timeline of Vulnerability and Recovery

Understanding how these attacks unfolded requires a close examination of the timelines, which reveal glaring windows of exposure during which malicious actors held unfettered administrative control over critical digital infrastructure.

• March 11, 2026: Suspicious foreign login attempts targeting the Shri Dharmasthala domain account begin from IP addresses in Sweden and Switzerland. These alerts go unnoticed by the management team.
• June 10, 2026: The shridharmasthala.org domain is fraudulently transferred without authorization. The website continues operating via mirrored or maintained redirection, masking the theft.
• August 5, 2026 (Approx. 8 Weeks Later): The Shri Dharmasthala Manjunatheshwara Educational Society formally files a complaint under the UDRP with the Czech Arbitration Court.
• September 14, 2026: Panelist Dietrich Beier rules in favor of the temple, ordering the immediate transfer of the domain back to the rightful owners, citing common law trademark rights.
• August 28, 2024: Indira IVF’s domain is renewed for five years by a shareholder, maintaining standard operations.
• October 26, 2024: A secondary actor (later identified as respondent Saurav Shinde) allegedly purchases the Indira IVF domain via a peer-to-peer transaction on Facebook and Telegram.
• October 31, 2024: indiraivf.com is officially transferred away from the company’s control panel without authorization, moving to the registrar Hostinger.
• January 2025: Indira IVF discovers the domain is missing after a brief service suspension forces emergency IT intervention to prevent widespread reputational and operational damage.
• February 25, 2025: Hostinger discloses the details of the new registrant following inquiries.
• May 2025: Panelist Darius Sauliūnas rules under the UDRP that Shinde’s purported peer-to-peer purchase cannot legitimize a domain acquired via an underlying account hack, ordering the return of indiraivf.com.

3. Supporting Data: The Mechanics of Bad Faith and Legal Hurdles

The legal battles fought by Shri Dharmasthala and Indira IVF highlight the strict parameters—and frustrating limitations—of international domain dispute resolution.

The Weaponization of Redirection

In both cases, the respondents left the stolen domains pointing to the complainants’ original websites. Under standard legal reasoning, one might assume this minimizes harm. However, international arbitration panels view this tactic as a hallmark of bad faith.

Citing Section 3.1.4 of the WIPO Overview of WIPO Panel Views on Selected UDRP Questions, panels established that retaining control over domain redirection creates an ongoing, implicit threat to the trademark holder. For Shri Dharmasthala, which relies on a Razorpay-integrated payment gateway for commercial and religious services, a stranger holding the underlying domain controls the very infrastructure of its digital commerce. For Indira IVF, the threat materialized when a brief service suspension forced emergency interventions to avert patient deception and phishing risks.

The Trademark Threshold

The UDRP was originally designed to combat cybersquatting—the speculative registration of domains matching trademarks. It was never built to handle account compromises or sophisticated cyberheists. Consequently, complainants must clear rigorous hurdles:

1. Prove the domain is identical or confusingly similar to a trademark.
2. Prove the registrant has no rights or legitimate interests.
3. Prove the domain was registered and is being used in bad faith.

While Indira IVF relied on registered Indian trademarks (such as Application No. 2566949 for INDIRA), Shri Dharmasthala held no registered mark for its name. The temple successfully established common law rights through decades of continuous use since 2003, heavy media coverage, and high visitor volume. Smaller institutions lacking extensive historical footprints would likely find this avenue closed to them.

Furthermore, because the UDRP text requires proof that a domain was registered in bad faith, panels were forced to stretch legal doctrine. Panelists treated the fraudulent acquisition of an existing domain as legally equivalent to an initial registration, drawing on precedents like Worldcom Exchange v. Wei.com.

4. Official Responses and Accountability Gaps

Despite securing the return of their digital properties, neither arbitration decision resulted in identifying, prosecuting, or penalizing the hackers. The UDRP process does not award damages, assess costs, or investigate the underlying criminal activity. It merely fixes the pointer on the DNS map.

While Indira IVF reported the cyber incident to Indian law enforcement authorities, public records do not indicate any arrests or recoveries of damages.

More concerning is the complete lack of accountability demanded of the digital supply chain—specifically, the domain registrars and resellers. In both incidents, automated transfer notifications sent by registrars failed to reach human oversight because the recipient email inboxes were either compromised simultaneously or flooded beyond practical monitoring. Yet, no registrar or reseller has faced regulatory penalties for permitting unauthorized transfers or failing to enforce baseline security controls like mandatory two-factor authentication.

5. Broader Implications: Regulatory Blind Spots in India

These incidents lay bare a dangerous disconnect between judicial interventions and the everyday security standards enforced across India’s digital ecosystem.

The Limits of Delhi High Court’s e-KYC Directives

In December 2025, the Delhi High Court issued sweeping directives addressing domain name security, mandating e-KYC verification for registrants at the time of registration and periodically thereafter. The court also restricted privacy masking of registrant details and made Indian court orders binding on registrars served via email.

While these measures successfully target identity fraud and malicious initial registrations, they completely ignore the security of existing accounts. As currently reported, Indian regulations do not mandate that registrars or resellers enforce two-factor authentication, nor do they specify legal protocols for handling unauthorized account transfers when reported by frantic customers.

The Reseller Hazard

The Indira IVF case underscores the systemic risk posed by the reseller layer. Global IT Providers operated the control panel through which the domain was hijacked. Because resellers operate under broader registrar contracts rather than direct ICANN accreditation, security standards are fragmented and opaque.

MediaNama’s ongoing investigations into the matter reveal a near-total absence of Indian rules or advisories establishing mandatory security baselines for registrar or reseller customer accounts. Queries dispatched to key national authorities—including the National Internet Exchange of India (NIXI) and the Indian Computer Emergency Response Team (CERT-In)—along with the involved registrars (Hostinger and Global IT Providers), aim to clarify institutional liability and incident-reporting mandates. This report will be updated as official responses are received.

Conclusion: A Wake-Up Call for Digital Governance

The successful recovery of the Shri Dharmasthala and Indira IVF domains should be viewed less as a victory and more as a lucky escape. Relying on international trademark arbitration to rescue compromised corporate accounts is an expensive, legally complex, and reactive remedy.

As cybercriminals increasingly target the administrative backdoors of institutional websites, a working web page can no longer be trusted as a symbol of digital safety. Indian regulatory bodies, NIXI, and CERT-In must urgently step forward to establish binding baseline security mandates—including universal multi-factor authentication, strict transfer verification protocols, and rigorous accountability for registrars and resellers. Until structural security replaces retroactive dispute resolution, India’s premier institutions will remain one compromised password away from a silent corporate takeover.