123 Reg says customer data taken in 'AI-driven cyberattack'

UK domain registrar 123 Reg has told customers that their personal and account data was exposed in an intrusion on 18 September 2026, which the company described as "the first known AI-driven cyberattack against our company". Notification emails began landing this week, according to The Register, which reported the disclosure on 28 October 2026.

The company said the exposed information included contact details, "related customer relationship data", company VAT numbers and "product information from an application programming interface (API)". A spokesperson told The Register this meant names, phone numbers, countries, language and currency preferences, account creation dates, the products held on each account, and marketing preferences. The email to customers said the attacker's activity "was limited to reading" customer data, though the spokesperson added that "it's possible they created copies of the information", which is why 123 Reg chose to notify.

123 Reg, which is owned by GoDaddy, said early indications point to a China-nexus attacker. "Our investigation identified IP addresses that we assessed to be the core attacker infrastructure, which were hosted in China and Singapore, indicating a strong Chinese nexus," the spokesperson said. The company also said it found AI cyberattack "skills" hosted on Chinese infrastructure, "including copies of skills open sourced by Anthropic and several other AI exploitation frameworks and scripts". Skills, in this context, are packaged instructions and tools that an AI coding agent can load to perform tasks.

The registrar said artefacts left behind led it to suspect a Chinese state-sponsored group known for abusing Claude Code in attacks against at least 30 organisations. It also raised the possibility that the same group that struck several South Korean financial institutions was responsible. "The TA's mirror of 'anthropic_skills,' and the account naming conventions found on the Chinese servers are consistent with preparation of this class of AI-augmented operation," the spokesperson said.

123 Reg pointed to a CrowdStrike report, CSA-261162, published on 7 October 2026, which it said described an unknown, likely Chinese-speaking actor targeting several South Korean financial organisations from late September 2026. According to the spokesperson, that actor used ARTEX, an open-source Chinese-developed agentic penetration-testing tool released in July 2026, and the same tool was observed in the attack on 123 Reg. Agentic penetration-testing tools automate the steps of probing and exploiting a target with limited human input.

The company said it reported the attack to law enforcement, brought in outside cybersecurity support, and notified the US Federal Trade Commission as well as data protection authorities in the UK and the EU. It added that it worked with Singapore-based internet service providers to shut down the attacker's servers in that region, which helped disrupt the attack, alongside "other actions by us and industry partners".

123 Reg urged customers to watch for misuse of their data and to treat unexpected communications with caution. "If you receive a message or call and aren't sure it's from 123 Reg, go directly to our website and log in," the email said, adding that the company will never ask for passwords, payment details or verification codes by email, text or phone. It also recommended customers switch on two-step verification, with setup instructions available in account settings. "We apologize for any inconvenience this may have caused," the email said.