UK domain registrar 123 Reg (no relation – Ed) says it was the victim of an “AI-driven cyberattack” that exposed customer data.
Customers began receiving their notification emails this week, informing them that their contact information, "related customer relationship data," company VAT numbers, and "product information from an application programming interface (API)" were compromised.
A company spokesperson elaborated, saying this means that names, phone numbers, countries, language and currency preferences, account creation dates, the products on the account, and marketing preferences were affected.
123 Reg described the September 18 intrusion as "the first known AI-driven cyberattack against our company," and told The Register that early signs point toward a China-nexus attacker.
"Our investigation identified IP addresses that we assessed to be the core attacker infrastructure, which were hosted in China and Singapore, indicating a strong Chinese nexus," the spokesperson said.
"Our investigation further identified AI cyberattack 'skills' hosted on Chinese infrastructure, including copies of skills open sourced by Anthropic and several other AI exploitation frameworks and scripts."
They went on to say that many of the artefacts left behind led 123 Reg to suspect that a Chinese state-sponsored group, known for abusing Claude Code in attacks against at least 30 organizations, could be behind the break-in.
There is also a suspicion that the same group that hit a number of South Korea’s financial institutions using open-source Chinese AI tool ARTEX, was behind the attack on 123 Reg too.
"The TA's mirror of 'anthropic_skills,' and the account naming conventions found on the Chinese servers are consistent with preparation of this class of AI-augmented operation," the spokesperson told us.
"In addition, on October 7, 2026, CrowdStrike published CSA-261162, describing an unknown, likely Chinese-speaking actor that targeted several South Korean financial organizations starting in late September 2026, which is the same period during which we were attacked.
"That actor used ARTEX, an open-source Chinese-developed agentic penetration-testing tool released in July 2026, which was also observed to be used in the attack that targeted us."
The GoDaddy-owned registrar reported the attack to law enforcement agencies, brought in outside cybersecurity support, and notified the FTC, as well as the data protection authorities in the UK and EU.
The company spokesperson added that it worked with Singapore-based ISPs to shut down the attacker's servers in the region, which helped disrupt the attack, in addition to "other actions by us and industry partners."
123 Reg's email to customers stated the attacker's activity "was limited to reading" customer data, although the spokesperson told us "it's possible they created copies of the information," and that this is what prompted the notification.
The registrar urged customers to stay alert to the potential misuse of their data, and to treat communications appearing to come from the company with caution.
"If you receive a message or call and aren't sure it's from 123 Reg, go directly to our website and log in," the email said. "We will never contact you to request your password, payment details, or verification codes by email, text, or phone.
"We also strongly recommend turning on two-step verification (2SV), which helps keep your account protected even if someone tricks you into sharing your password. You can find instructions for setting up 2SV in your 123 Reg account.
"We apologize for any inconvenience this may have caused." ®
