Likely an inside job. I had a similar experience with AWS where my account was compromised despite the fact that I had all the proper security features enabled. It was later discovered internal contractors were responsible. But up to that point AWS blamed the issue on me with no proof. A call to the AG office in my state got the ball rolling and initiated an investigation that finally got a manager to take the case seriously.
If you read farther down, it’s obviously an inside job in the incompetent, not malicious, sense. Their employee did not do anything remotely resembling following procedures, misread an email to an outrageous degree, and transferred the wrong domain.
I don’t think you read the article. GoDaddy transferred the domain to someone in a local chapter of the same organization. When that person realized what happened, they called the original owner and got everything fixed. There’s no way this is an “inside job” of any kind.
That doesn't make any sense. The entire reason it was undone is because the recipient told GoDaddy support that they transferred the wrong domain to her. So how could this have been an inside job?
but why? why would an insider put the wrong domain into a strangers account that has no interest in using the domain and went out of her way to give it back to the rightful owners?
The explanation is at the end of the article: another GoDaddy customer asked for the transfer of a similar-looking domain name, and they transferred the wrong domain.