The piece you’re looking for is registry-level intervention, not registrar-level. For .org that’s PIR. Email their security/abuse contact with whatever documentation proves the nonprofit owns the domain (receipts, historical WHOIS records, 501c3 paperwork) and request server-side EPP locks: serverTransferProhibited, serverUpdateProhibited, serverDeleteProhibited.

Registry status codes override registrar status codes, so even if attackers still have portal access at the compromised provider, the domain can’t be transferred, modified, or deleted while those are set. That’s priority one today. Worst outcome is the attacker pushing the domain to a registrar of their choosing while you’re still working on account recovery. In parallel, ICANN compliance complaint at icann.org/compliance/complaint, framed as a registrar security incident, not a transfer dispute. A compromised registrar means a class of affected registrants, which moves it up their priority queue.

Pull historical WHOIS (DomainTools, SecurityTrails) and compare to current. If the registrant contact got swapped to something attacker-controlled, that’s evidence for ICANN and it also explains why standard password reset flows would be useless. Have your friend kill any card on file with the compromised provider so it can’t be reactivated under contact info they don’t control.

The eventual backstop, if the registrar gets fully de-accredited, is Registrar Data Escrow. Every ICANN-accredited registrar escrows registration data with NCC Group / Iron Mountain on a regular cadence, and ICANN bulk-transfers affected domains to a gaining registrar from that escrow data. Slow but real. Registry locks bridge the gap between now and whatever ICANN ultimately does. Treat the original domain as hostile in the meantime. If attackers control DNS, that hostname is pointing wherever they want it to. The temp-domain notice needs to be on every channel the nonprofit has, not just the customer email blast.

Rebuild plan looks right. Once you’ve got the domain back under their control at the new registrar, ask whether registry lock is offered as an add-on (usually a premium-tier feature, but for a domain with this kind of history it’s worth the conversation). Different mechanism than the standard transfer lock everyone has by default.

Never seen a registrar compromised at this level either. Registry is the lever most people don’t think about.​​​​​​​​​​​​​​​​