UK domain registrar 123 Reg has disclosed that it suffered an AI-driven cyberattack in September that compromised customer data. The company said it notified affected customers this week after discovering that an attacker accessed personal and account information. Early indications from the company point to a Chinese state-sponsored group.
123 Reg, owned by GoDaddy, described the September 18 intrusion as "the first known AI-driven cyberattack against our company". The company said it began notifying customers this week that their contact information, related customer relationship data, VAT numbers, and product information from an API were exposed. This included names, phone numbers, countries, language and currency preferences, account creation dates, products on the account, and marketing preferences.
A company spokesperson told The Register that early signs point toward a China-nexus attacker. "Our investigation identified IP addresses that we assessed to be the core attacker infrastructure, which were hosted in China and Singapore, indicating a strong Chinese nexus," the spokesperson said. They added that the investigation identified AI cyberattack tools on Chinese infrastructure, including copies of skills open sourced by Anthropic and other exploitation frameworks.
The spokesperson said the techniques and artefacts are consistent with a Chinese state-sponsored group known for using Claude Code in attacks against at least 30 organisations. The company also suspects a link to a group that targeted South Korean financial institutions using the open-source Chinese AI tool ARTEX. CrowdStrike published a report on October 7 about a likely Chinese-speaking actor that attacked several South Korean financial organisations starting in late September, the same period as the 123 Reg attack.
123 Reg reported the breach to law enforcement, brought in outside cybersecurity support, and notified the FTC and data protection authorities in the UK and EU. The company worked with Singapore-based ISPs to shut down the attacker's servers in the region.
The company said the attacker's activity was limited to reading customer data, though the spokesperson said it is possible copies were made. The registrar urged customers to be cautious with unsolicited communications and recommended enabling two-step verification. The email to customers advised them to go directly to the 123 Reg website if unsure about a message, and that the company would never ask for passwords, payment details or verification codes by email, text or phone.
Analysis
Why This Matters
- Breach of a major domain registrar can affect many customers worldwide, exposing personal and business data to potential fraud or phishing.
- The use of AI tools in the attack highlights an evolving threat landscape where automated, AI-augmented tactics become more common.
- The incident may prompt other registrars and internet infrastructure companies to reassess their defenses against AI-driven threats.
Background
123 Reg is a UK-based domain registrar owned by GoDaddy, registering millions of domains. The company has not disclosed the total number of affected customers. The attack is one of several recent incidents where threat actors have used open-source AI tools to automate penetration testing and data theft, marking a shift in cyber operations toward greater use of generative AI.
What to Watch
- Whether law enforcement or cyber agencies identify and attribute the attackers more precisely.
- If other companies using similar infrastructure disclose related attacks.
- How AI security frameworks evolve to counter AI-powered cyber threats.
Checked
12 claims in this story checked against 1 source: 8 supported.
Show each claim
- SupportedThe headline says 123 Reg reported an AI-driven cyberattack exposed customer data and a China-linked threat group is suspected.www.theregister.com - Articles: “123 Reg (no relation – Ed) says it was the victim of an “AI-driven cyberattack” that exposed customer data.”
- Partly supportedThe summary says the GoDaddy-owned UK registrar notified customers and cites the involvement of state-backed actors.www.theregister.com - Articles: “The GoDaddy-owned registrar reported the attack to law enforcement agencies, brought in outside cybersecurity support, and notified the FTC, as well as the data protection authorities in the UK and EU.”
- Supported123 Reg disclosed an AI-driven cyberattack in September that compromised customer data.www.theregister.com - Articles: “UK domain registrar 123 Reg (no relation – Ed) says it was the victim of an “AI-driven cyberattack” that exposed customer data.”
- Partly supported123 Reg notified affected customers this week after discovering an attacker accessed personal and account information.www.theregister.com - Articles: “Customers began receiving their notification emails this week, informing them that their contact information, “related customer relationship data,” company VAT numbers, and “product information from an application programming interface (API)” were compromised.”
- Partly supportedEarly indications from 123 Reg point to a Chinese state-sponsored group.www.theregister.com - Articles: “123 Reg described the September 18 intrusion as “the first known AI-driven cyberattack against our company,” and told The Register that early signs point toward a China-nexus attacker.”
- Supported123 Reg described the September 18 intrusion as “the first known AI-driven cyberattack against our company”.www.theregister.com - Articles: “123 Reg described the September 18 intrusion as “the first known AI-driven cyberattack against our company,””
- SupportedThe exposed information included names, phone numbers, countries, language and currency preferences, account creation dates, products on the account and marketing preferences.www.theregister.com - Articles: “A company spokesperson elaborated, saying this means that names, phone numbers, countries, language and currency preferences, account creation dates, the products on the account, and marketing preferences were affected.”
- SupportedA spokesperson said the investigation identified attacker infrastructure hosted in China and Singapore, indicating a strong Chinese nexus.www.theregister.com - Articles: ““Our investigation identified IP addresses that we assessed to be the core attacker infrastructure, which were hosted in China and Singapore, indicating a strong Chinese nexus,” the spokesperson said.”
- SupportedThe spokesperson said the investigation found AI cyberattack tools on Chinese infrastructure, including Anthropic skills and other exploitation frameworks.www.theregister.com - Articles: ““Our investigation further identified AI cyberattack 'skills' hosted on Chinese infrastructure, including copies of skills open sourced by Anthropic and several other AI exploitation frameworks and scripts.””
- Partly supportedThe spokesperson said techniques and artefacts were consistent with a Chinese state-sponsored group known for using Claude Code in attacks against at least 30 organisations.www.theregister.com - Articles: “They went on to say that many of the artefacts left behind led 123 Reg to suspect that a Chinese state-sponsored group, known for abusing Claude Code in attacks against at least 30 organizations, could be behind the break-in.”
- Supported123 Reg suspects the group that targeted South Korean financial institutions using ARTEX was also behind its attack.www.theregister.com - Articles: “There is also a suspicion that the same group that hit a number of South Korea’s financial institutions using open-source Chinese AI tool ARTEX, was behind the attack on 123 Reg too.”
- Supported123 Reg said the attacker’s activity was limited to reading customer data, though copies may have been made.www.theregister.com - Articles: “123 Reg's email to customers stated the attacker's activity “was limited to reading” customer data, although the spokesperson told us “it's possible they created copies of the information,””
