123 Reg: "AI-driven cyberattack" exposed customer contact and account data; registrar suspects a China-nexus actor
123 Reg (UK domain registrar)
UK domain registrar 123 Reg (owned by GoDaddy) is notifying customers that a September 18 2026 intrusion it calls "the first known AI-driven cyberattack against our company" exposed names, phone numbers, countries, language and currency preferences, account creation dates, products on the account, marketing preferences and company VAT numbers, plus product information from an API. The company says the attacker's activity was limited to reading data but copies may have been made. It traced core attacker infrastructure to China and Singapore, found AI attack "skills" on it (including copies of skills open sourced by Anthropic), and suspects a link to the actor CrowdStrike tied to ARTEX attacks on South Korean financial firms. Customers are told to distrust messages claiming to be from 123 Reg and to turn on two-step verification.
Why this severity: Customer contact, account and VAT data exposed; no passwords or account access reported; phishing risk
- Started
- Sep 18, 2026
Affected
- 123 Reg customer accounts
Fixed in
No fixed release yet
Timeline2
Customers receive breach notification emails; 123 Reg tells The Register it suspects a China-nexus actor and reported the attack to law enforcement, the FTC and UK and EU data protection authorities.
Attacker breaks into 123 Reg systems and reads customer data, in what the company calls an AI-driven cyberattack.
News & write-ups1
Notes & caveats
123 Reg has not said how many customers are affected or how the attacker got in. It says no passwords were taken; watch for phishing that impersonates 123 Reg and enable two-step verification.
Get an email when a new major security incident drops. No spam, unsubscribe any time.
