Technical Issue in RST Testing Environment

On 7 October 2025, the Internet Corporation for Assigned Names and Numbers (ICANN) was alerted to a technical issue in the Operational Test and Evaluation (OT&E) environment for Registry System Testing (RST) v2.0. The OT&E and production environments were taken offline while an investigation was conducted.

ICANN identified the root cause of the technical issue, which allowed a limited number of RST users to view identifiable organizational information of another RST user, thus enabling those users to know another applicant that is using the system. ICANN conducted a thorough internal forensic investigation and determined that only the OT&E environment was impacted. The production environment was not affected. No personal data was exposed, with the exception of a single minor and limited instance. A total of 14 of 26 organizations using RST OT&E were affected. All affected organizations have been notified.

ICANN resolved the root cause of the technical issue and is conducting rigorous system testing to ensure that both the OT&E and production environments function properly. Out of an abundance of caution, ICANN engaged a third-party consulting company to audit the findings. The OT&E and production environments will be brought back online no earlier than 12 November 2025.

RST v2.0 is used to evaluate the technical capabilities of applicants in the New gTLD Program: Next Round Registry Service Provider (RSP) Evaluation Program. All RSPs that participate in the New gTLD Program must clear technical testing using RST v2.0. The OT&E environment allows prospective RSPs to develop and validate their implementations prior to a formal technical evaluation in a production setting.

The date to announce the initial list of successfully evaluated RSPs was originally scheduled for 9 December 2025. Due to the system downtime, this date will be adjusted to ensure that RSP applicants and ICANN have adequate time to complete the necessary remaining evaluation steps. This new date will be determined once the environments are ready to be brought back online and will be communicated directly to RSP applicants and to the community. This adjustment does not change the projected opening of the New gTLD Program: Next Round planned for April 2026.

ICANN is committed to addressing technical issues quickly and thoroughly to ensure the safety of its systems and users. While it is important to restore service as quickly as possible, the security and trustworthiness of ICANN's technical systems is of utmost importance. ICANN appreciates the patience of RSP applicants while work is done to bring the environments back online. Users are encouraged to report vulnerabilities to ICANN systems or networks. More information is available at https://www.icann.org/vulnerabilities.

This issue has been logged on ICANN's Cybersecurity Incident Log.

About ICANN