The Internet Corporation for Assigned Names and Numbers (ICANN) today provided an update on its investigation into a data exposure issue in the New gTLD Applicant and GDD (Global Domains Division) portals, first reported on 1 March 2015
In its 30 April announcement, ICANN noted its intention to disclose to affected users the identity of any user(s) that viewed their information without authorization by May 27th 2015.
Based on the information that ICANN has collected to date our investigation leads us to believe that over 60 searches, resulting in the unauthorized access of more than 200 records, were conducted using a limited set of user credentials.
The New gTLD Applicant and GDD portals contain information from applicants to ICANN’s New gTLD Program and new gTLD registry operators. No other systems were affected by this issue.
SourceICANN sincerely regrets this incident. We continue to deploy security-based updates on a regular basis. Enhancing the security controls and privacy of the ICANN portals is part of a broader, multi-year effort to harden all of ICANN’s digital services.
