The company took the system offline on Thursday afternoon, just hours before applications were due to close after being open for more than three months.
In a dramatic announcement at about 0200 on Friday morning UK time, Akram Atallah, chief operating office at the organisation which is in overall charge of the allocation of new IP addresses and "top-level domains", said that a glitch "has allowed a limited number of users to view some other users' file names and user names in certain scenarios."
He said that "Out of an abundance of caution, we took the system offline to protect applicant data. We are examining how this issue occurred and considering appropriate steps forward."
Being able first to see rival bids, which are meant to be confidential, could give applicants important clues about how to word their own bids for the potentially unlimited number of new domains on offer.
Icann's move came on what was to be the final day for applications for new global top-level domains (gTLDs) in which applicants could choose to become the owner of online properties such as ".sex" or ".adult" and control the allocation of website names within them.
It said on Thursday that it will reopen applications next week, and extend the deadline to Friday.
Charlie Abrahams, vice-president for Europe, the Middle East and Africa of the IP company MarkMonitor, which has acted for companies including Apple, told the Guardian that Icann had not provided any extra detail, so it was unclear how many applications had been compromised. "What we can say is that the domain name space is definitely an area demanding ever increasing security - just last year there were a number of incidents involving the hacking of registries or registrars that compromised major companies including the Telegraph and Vodafone in the UK."
Kieren McCarthy, who formerly worked at Icann and now runs dot-nxt, a consultancy on internet governance, told the Guardian that the organisation might bear some liability if applicants lost out because of the fault: "it depends on what people could see. And if a competing applicant changed details at some point through the process. If someone loses their bid - most likely if the same name is applied for under a 'community' application and so gets precedence - then the losing party may sue and use discovery to subpoena records relating to what the problem was and whether ICANN was responsible or, worse, knew about it."
He said that the gTLD auction process has otherwise been "run extremely well" but that "Icann certainly has a lot of question marks over it at the moment. It is at a critical crossroads. It is not up the standards of a body with such as important operational role, and, through its own decisions, it is overwhelmed with work and so may have been taking shortcuts."
Cities, companies and individuals had been expected to bid for a wide variety of the new gTLDs. Applicants had to pay $185,000, and might then have to enter negotiations with rivals if they both sought the same suffix. Icann has not explained exactly how it will handle dispute resolution - which could, in theory, pit the giant Apple Inc against the American Apple Growers' Association for the ".apple" domain. (It is not known if either has bid for a top-level domain.)
Abrahams said: "On the specific question of who wins a competed for .brand application, provided both applicants met the many technical, financial and legal requirements of a gTLD application, it would come down to a straight auction as to who won the right to run that registry - all applications were (originally) due in by yesterday, and chronology of submission is not part of the evaluation. Examples of registries that may fall into the competed-for category are .eco and .poker."
However in some cases trademark owners could argue that they have primacy over a domain claim - which might in turn trigger a costly courtroom battle.
