123 Reg says AI-driven cyberattack exposed customer contact details and VAT numbers

TLDR

• 123 Reg says an AI-driven attack on 18 September exposed contact details, VAT numbers and API product information.¹
• 123 Reg suspects a China-nexus attacker, possibly the group that used ARTEX against South Korean financial firms.¹³
• VINnews reports GoDaddy's notice to Websites + Marketing customers gives the same date and says no passwords were obtained.²

The Register reports that UK domain registrar 123 Reg says it was the victim of an "AI-driven cyberattack" on 18 September, and that customers began receiving notification emails this week.¹ The emails say customers' contact information, "related customer relationship data", company VAT numbers and "product information from an application programming interface (API)" were compromised.¹ A company spokesperson told The Register this covers names, phone numbers, countries, language and currency preferences, account creation dates, the products on the account and marketing preferences.¹ 123 Reg called it "the first known AI-driven cyberattack against our company", and The Register describes the registrar as GoDaddy-owned.¹

The customer email says the attacker's activity "was limited to reading" the data, though the spokesperson said it is possible copies were made, which prompted the notification.¹ 123 Reg reported the attack to law enforcement, brought in outside cybersecurity support and notified the FTC and data protection authorities in the UK and EU, and says it worked with Singapore-based ISPs to shut down the attacker's servers there.¹ VINnews reports that GoDaddy sent customers of its Websites + Marketing product a notice giving the same 18 September date, saying the activity was detected the next day and that the attacker read profile and settings information, including contact details customers supplied for publication on their websites, through an API.² According to VINnews, GoDaddy says the attacker did not obtain passwords or access customer accounts, calls it the first known AI-driven cyberattack against the company, and says the incident has been contained.² Neither The Register nor VINnews gives a figure for how many customers are affected.¹²

The attribution is 123 Reg's own assessment, as reported by The Register.¹ The spokesperson said the investigation identified IP addresses it assessed to be core attacker infrastructure, hosted in China and Singapore, "indicating a strong Chinese nexus", along with AI attack "skills" hosted on Chinese infrastructure, including copies of skills open sourced by Anthropic and several other AI exploitation frameworks and scripts.¹ On that basis 123 Reg suspects a Chinese state-sponsored group known for abusing Claude Code in attacks against at least 30 organisations, and also suspects the group that hit South Korean financial institutions using the open-source Chinese AI tool ARTEX.¹ The spokesperson said ARTEX, an open-source agentic penetration-testing tool released in July 2026, was also observed in the attack on 123 Reg.¹

CrowdStrike's 7 October report says a campaign against South Korean financial organisations used ARTEX alongside large language models and was active from late September to early October 2026, whereas 123 Reg dates its own intrusion to 18 September.¹³ CrowdStrike says the activity has not been attributed to a named adversary, and assesses with moderate confidence that the actor is likely a Chinese speaker and financially motivated.³ TechCrunch reports that South Korean financial firms were hit by another wave of attacks, with incidents affecting Daishin Securities, Mirae Asset Global Investments and Bithumb, and that officials are still investigating the root cause.⁴

Why it matters: both companies warn customers to stay alert for misuse of the exposed contact details, while the China-nexus and ARTEX link remains 123 Reg's own suspicion and CrowdStrike's report on the ARTEX actor names no adversary.¹²³