She hasn't lost the domain, she's lost the ability to control its DNS at the provider she's currently using (the nameservers she set).
So as sibling says it's a case of changing the ns to some other provider, or else I suppose a support case to somehow prove you do own the domain, so please assign control back to your account.
Well, if the email address you use at the registrar is under the domain the attacker now controls, they can hijack it and potentially escalate to taking over your registrar account as well. Hopefully you have 2FA set up and your registrar enforces it properly.
So as sibling says it's a case of changing the ns to some other provider, or else I suppose a support case to somehow prove you do own the domain, so please assign control back to your account.