Word on the street is that this attack was a social engineering attack against the domain registrar. If this truly is the case, then there is basically nothing that could be done by ICANN to prevent it.
I was thinking about this sort of thing the other day-- and wondering whether it is still a 'defacement' if only a small subset of users see the bad page.. Example-- say I poison DNS on verizon such that amazon.com points to some other IP where I have a 1337 PWND message. Amazon will appear to be owned for all Verizon customers- but the attack has little to do with Amazon. Does this count as a defacement?