All I can say to this, as a GoDaddy customer, is WOW. Just WOW WOW WOW.
GoDaddy transferred the ownership details to a 3rd Party without confirming the changes with the original account owner, and then refused to transfer them back to the original owner, even after filing a dispute, because they were no longer the owner (because the now-owner/attacker denied the request apparently).
I also hold PayPal highly accountable for this, as that’s how the attacker apparently gained access to the personal information that started the whole chain reaction. I no longer maintain a Paypal account (at least not one linked to any cards or bank accounts) but I DO use GoDaddy and I am VERY worried about this now.
My domain isn’t worth squat, but the idea that someone could take it away from me is thoroughly depressing.
I entered a support ticket with GoDaddy asking for clarification and a response and I’ll let you know if I get one.
Good luck Naoki.