ICANN has provided information on this hacking incident which appears to have been smart enough to fool its own staff.

I would expect it's too early to say how bad this is until it's fully understood what the hacker took away from the attack.

Either way, it doesn't sound too good.

ICANN is investigating a recent intrusion into our systems. We believe a "spear phishing" attack was initiated in late November 2014. It involved email messages that were crafted to appear to come from our own domain being sent to members of our staff. The attack resulted in the compromise of the email credentials of several ICANN staff members.ICANN Investigates "Spear Phishing" Attack After Obtaining Admin Access To Files in CZDS [icann.org]

The Centralized Zone Data System (czds.icann.org)
The attacker obtained administrative access to all files in the CZDS. This included copies of the zone files in the system, as well as information entered by users such as name, postal address, email address, fax and telephone numbers, username, and password. Although the passwords were stored as salted cryptographic hashes, we have deactivated all CZDS passwords as a precaution. Users may request a new password at czds.icann.org. We suggest that CZDS users take appropriate steps to protect any other online accounts for which they might have used the same username and/or password. ICANN is providing notices to the CZDS users whose personal information may have been compromised.