UK registrar 123 Reg tells customers an 'AI-driven cyberattack' exposed contact and account data and says it suspects a China-nexus attacker, according to The Register
UK domain registrar 123 Reg has emailed customers that their contact information, 'related customer relationship data', company VAT numbers and 'product information from an application programming interface (API)' were compromised in what it calls 'the first known AI-driven cyberattack against our company', according to The Register (28 October 2026).
A company spokesperson told The Register this means names, phone numbers, countries, language and currency preferences, account creation dates, the products on the account and marketing preferences were affected; The Register dates the intrusion to 18 September.
According to The Register, 123 Reg's email says the attacker's activity 'was limited to reading' customer data, while the spokesperson said 'it's possible they created copies of the information', which prompted the notification.
The spokesperson told The Register that IP addresses 123 Reg assessed as the core attacker infrastructure were hosted in China and Singapore, 'indicating a strong Chinese nexus', and that ARTEX, an open-source agentic penetration-testing tool, was observed in the attack; this attribution is 123 Reg's own assessment and has not been independently verified.
The Register says the GoDaddy-owned registrar reported the attack to law enforcement, brought in outside cybersecurity support, and notified the FTC and data protection authorities in the UK and EU.
- Product
- 123 Reg (GoDaddy-owned UK domain registrar) customer records
- Versions
- n/a — data breach
- Exploited in Australia?
- unknown
- Patch to
- 123 Reg customers: if a message or call claiming to be from 123 Reg seems doubtful, go directly to its website and log in; 123 Reg says it will never ask for passwords, payment details or verification codes by email, text or phone, and recommends turning on two-step verification (as quoted by The Register).