VULNpocalypse
MediumBreach / campaignMonitoring

123 Reg discloses AI-driven cyberattack on customer data, suspects China nexus

123 Reg says a September 18 intrusion exposed customer contact and account data, and customers should turn on two-step verification and watch for phishing.

Published
Exploitation
Yes, per 123 Reg, which says an attacker read customer data in a September 18 intrusion, entry point not confirmed

What happened

UK domain registrar 123 Reg says it was the victim of an “AI-driven cyberattack” that exposed customer data, according to The Register. The company calls the September 18 intrusion “the first known AI-driven cyberattack against our company.” The Register says customers began receiving notification emails in the week of the report.

According to the notification and a company spokesperson quoted by The Register, the affected data included:

  • names, phone numbers and countries
  • language and currency preferences
  • account creation dates and the products on the account
  • marketing preferences
  • company VAT numbers
  • “related customer relationship data” and “product information from an application programming interface (API)”

123 Reg’s email says the attacker’s activity “was limited to reading” customer data. The spokesperson told The Register “it’s possible they created copies of the information,” and said this possibility prompted the notification.

On attribution, 123 Reg says its investigation found IP addresses it assessed as core attacker infrastructure, hosted in China and Singapore, “indicating a strong Chinese nexus.” The spokesperson also said the company found AI cyberattack “skills” on Chinese infrastructure, including copies of skills open sourced by Anthropic. The company says it suspects that a Chinese state-sponsored group known for abusing Claude Code could be responsible. It also suspects a link to the actor that used the open-source tool ARTEX in attacks on South Korean financial institutions. In support, the spokesperson cited a CrowdStrike report, CSA-261162 (The Register). These are the company’s own assessments, and the sources contain no independent verification.

The GoDaddy-owned registrar says it reported the attack to law enforcement and brought in outside cybersecurity support. It also says it notified the FTC and data protection authorities in the UK and EU. The company adds that it worked with Singapore-based ISPs to shut down the attacker’s servers in that region (The Register).

The sources do not confirm:

  • how the attacker got in
  • the number of affected customers
  • whether passwords or payment data were involved

Am I affected?

  • You may be affected if you are a 123 Reg customer, particularly if you received the notification email described by The Register.
  • The listed data is contact, account and product information. Whether credentials or payment details were exposed is not confirmed.
  • The number of affected accounts is not confirmed.

What to do now

  1. Turn on two-step verification (2SV) in your 123 Reg account. The company “strongly” recommends this, and its email says setup instructions are in the account (The Register).
  2. Treat calls, texts and emails that appear to come from 123 Reg with caution. If you are unsure, the notification advises going directly to the 123 Reg website and logging in rather than following links.
  3. Never share your password, payment details or verification codes. 123 Reg says it will never ask for these by email, text or phone.
  4. Watch for misuse of your contact details, such as targeted messages that use your name, phone number, the products on your account or your account creation date. The company says this data was among the affected information.

Sources