Shri Dharmasthala Temple Successfully Recovers Stolen Digital Identity Through International Arbitration

The breach was facilitated by a combination of security vulnerabilities that are common even among large organizations. It was confirmed during the proceedings that Two-Factor Authentication (2FA) was not activated on the registrar account at the time of the incident. This lack of a secondary security layer proved fatal when the primary credentials were compromised. Furthermore, the investigation revealed that the administrative email address associated with the account—[email protected]—had appeared in various publicly reported data breaches. This exposure meant that the credentials used by the society’s administrators had likely been leaked in unrelated third-party hacks years prior, allowing the attackers to gain entry through a method known as credential stuffing or simple password exploitation.

The sophistication of the attack was further evidenced by the compromise of the society’s secondary recovery systems. The attackers managed to intercept or gain control of a Gmail account that served as a backup for authorization notifications. This allowed the perpetrators to receive and potentially delete the mandatory transfer authorization emails sent by the registrar, ensuring that the legitimate owners remained unaware of the theft until the domain had already been moved to a new registrar and a new owner.

Faced with the loss of their digital identity, the Shri Dharmasthala Manjunatheshwara Educational Society initiated formal legal proceedings to reclaim the domain. They filed a cybersquatting dispute under the Uniform Domain-Name Dispute-Resolution Policy (UDRP) with the Czech Arbitration Court. The UDRP is a global framework designed to resolve disputes involving the registration and use of internet domain names in bad faith. Because the domain in question was a .org extension, it fell under the jurisdiction of these international arbitration bodies, which are empowered to order the transfer of domains in cases of clear intellectual property theft or bad faith registration.

The society was represented in this complex international matter by Ankur Raheja, a legal expert specializing in domain name disputes and cyber law. The complaint argued that the domain was an essential component of the temple’s identity and that the fraudulent transfer constituted a clear case of cybersquatting and digital theft. To succeed in a UDRP claim, a complainant must typically prove that the domain name is identical or confusingly similar to a trademark in which they have rights, that the current holder has no legitimate interests in the name, and that the domain was registered or is being used in bad faith.

In the case of Shri Dharmasthala, the arguments were compelling. The name "Shri Dharmasthala" is inextricably linked to the 800-year-old institution and the educational society that bears its name. The long-term prior use of the domain since 2001 established a clear "prior right" that the fraudulent transfer could not supersede. The evidence of the compromised email accounts and the suspicious IP addresses from Sweden, Switzerland, and Japan provided the necessary proof of bad faith and unauthorized activity.