# 123 Reg: "AI-driven cyberattack" exposed customer contact and account data; registrar suspects a China-nexus actor · pwn.watch > UK domain registrar 123 Reg (owned by GoDaddy) is notifying customers that a September 18 2026 intrusion it calls "the first known AI-driven cyberattack against our company" exposed names, phone numbers, countries, language and currency preferences, account creation dates, products on the account, marketing preferences and company VAT numbers, plus product information from an API. The company says the attacker's activity was limited to reading data but copies may have been made. It traced core attacker infrastructure to China and Singapore, found AI attack "skills" on it (including copies of skills open sourced by Anthropic), and suspects a link to the actor CrowdStrike tied to ARTEX attacks on South Korean financial firms. Customers are told to distrust messages claiming to be from 123 Reg and to turn on two-step verification. Page: https://pwn.watch/i/123-reg-ai-driven-cyberattack-customer-data-oct-2026 · generated 2026-10-28T15:17:35.157Z ## Status - Severity: medium · status: live · patch: no-fix-needed - Product: 123 Reg (UK domain registrar) - Started: 2026-09-18 - Affected: 123 Reg customer accounts ## Follow this incident - RSS (one item per update): https://pwn.watch/i/123-reg-ai-driven-cyberattack-customer-data-oct-2026/feed.xml - JSON Feed: https://pwn.watch/i/123-reg-ai-driven-cyberattack-customer-data-oct-2026/feed.json - Full data (timeline, sources, posts, agentBrief): https://pwn.watch/i/123-reg-ai-driven-cyberattack-customer-data-oct-2026.json - This file: https://pwn.watch/i/123-reg-ai-driven-cyberattack-customer-data-oct-2026/llms.txt ## Updates (newest first) - 2026-10-28: Customers receive breach notification emails; 123 Reg tells The Register it suspects a China-nexus actor and reported the attack to law enforcement, the FTC and UK and EU data protection authorities. (https://www.theregister.com/cyber-crime/2026/10/28/123-reg-discloses-ai-cyberattack-on-customer-data-suspects-china-nexus/5305936) - 2026-09-18: Attacker breaks into 123 Reg systems and reads customer data, in what the company calls an AI-driven cyberattack. (https://www.theregister.com/cyber-crime/2026/10/28/123-reg-discloses-ai-cyberattack-on-customer-data-suspects-china-nexus/5305936) ## Fix brief # Security brief: 123 Reg: "AI-driven cyberattack" exposed customer contact and account data; registrar suspects a China-nexus actor Source: https://pwn.watch/i/123-reg-ai-driven-cyberattack-customer-data-oct-2026 · status: live · severity: medium · updated Oct 28, 2026, 11:58 UTC ## Patch status **NO FIX NEEDED: no action on your side beyond verification.** ## What it is UK domain registrar 123 Reg (owned by GoDaddy) is notifying customers that a September 18 2026 intrusion it calls "the first known AI-driven cyberattack against our company" exposed names, phone numbers, countries, language and currency preferences, account creation dates, products on the account, marketing preferences and company VAT numbers, plus product information from an API. The company says the attacker's activity was limited to reading data but copies may have been made. It traced core attacker infrastructure to China and Singapore, found AI attack "skills" on it (including copies of skills open sourced by Anthropic), and suspects a link to the actor CrowdStrike tied to ARTEX attacks on South Korean financial firms. Customers are told to distrust messages claiming to be from 123 Reg and to turn on two-step verification. Severity detail: Customer contact, account and VAT data exposed; no passwords or account access reported; phishing risk - Product: 123 Reg (UK domain registrar) ## Affected versions - 123 Reg customer accounts ## Check whether you're affected No generic command applies (the product is a hosted service, appliance or desktop app). Check the installed version in its admin UI / About screen and compare with the versions above. ## Fix No fixed version is listed. Follow the vendor advisory below. ## Secrets to rotate This incident involves possible credential exposure. Rotate any credentials (API keys, tokens, env vars, SSH keys) that were present on affected systems or in affected builds while vulnerable/compromised versions were installed, and review access logs. ## Latest updates - Oct 28, 2026: Customers receive breach notification emails; 123 Reg tells The Register it suspects a China-nexus actor and reported the attack to law enforcement, the FTC and UK and EU data protection authorities. - Sep 18, 2026: Attacker breaks into 123 Reg systems and reads customer data, in what the company calls an AI-driven cyberattack. ## Write-ups & news - [123 Reg discloses 'AI cyberattack' on customer data, suspects China nexus](https://www.theregister.com/cyber-crime/2026/10/28/123-reg-discloses-ai-cyberattack-on-customer-data-suspects-china-nexus/5305936) ## Caveats 123 Reg has not said how many customers are affected or how the attacker got in. It says no passwords were taken; watch for phishing that impersonates 123 Reg and enable two-step verification. --- Machine-readable: https://pwn.watch/i/123-reg-ai-driven-cyberattack-customer-data-oct-2026.json · all incidents: https://pwn.watch/incidents.json. Verify against the vendor advisory before changing production systems.