Threat intel

123 Reg, the UK domain registrar and web host owned by GoDaddy, has emailed customers to say an intruder read their contact and account data on September 18. The company calls it "the first known AI-driven cyberattack against our company" and says early signs point to an attacker with a China nexus. The emails went out in the last week of October, and The Register reported the incident on October 28.

If you hold a domain, hosting or email with 123 Reg, assume your name, phone number and the list of products on your account are in someone else's hands. No passwords or payment details are listed as taken. What leaked is enough to write a convincing fake renewal notice or support call, and 123 Reg has not said how many customers are affected.

What was taken

The customer email lists "contact information", "related customer relationship data", company VAT numbers and "product information from an application programming interface (API)". A spokesperson gave a fuller list: names and phone numbers, account creation dates, the products on each account, country, preferred language and currency, and marketing preferences.

The email says the attacker's activity "was limited to reading" customer data. The spokesperson added that "it's possible they created copies of the information." Plan as if a full copy exists, since an attacker who can read records over an API can save every response.

How it worked

123 Reg has not published the entry point. The reporting says the data came out through an API, which is the interface the registrar's own systems use to look up account and product records. An API like that returns one customer's record per request when it works as intended. Someone holding a valid key or session for it, or one that skips a per-customer authorisation check, can walk through customer IDs and pull every record in turn. That is the pattern the exposed fields fit, but 123 Reg has not confirmed which of these happened, and nobody has said how the attacker reached the API.

The "AI-driven" label rests on what investigators found on the attacker's servers. According to 123 Reg, the core infrastructure sat in China and Singapore, and the Chinese servers held AI attack "skills": copies of skills Anthropic open-sourced, plus material from several other AI exploitation frameworks and scripts. The company has not described how AI models were used during the intrusion itself.

Who 123 Reg thinks did it

The attribution is 123 Reg's own and has not been independently confirmed. The company points to a Chinese state-sponsored group it says is known for misusing Claude Code against at least 30 organisations. Anthropic disclosed a campaign matching that description in November 2025, in which a group it called GTG-1002 used Claude Code to attempt intrusions against roughly 30 targets.

123 Reg also says ARTEX, an open-source agentic penetration-testing tool developed in China and released in July, was seen in its attack. It cites CrowdStrike advisory CSA-261162, published October 7, which describes a likely Chinese-speaking actor using ARTEX against South Korean financial firms from late September. Coverage disagrees on how well this fits. 123 Reg says the periods overlap; Daily Security Review points out that the September 18 intrusion came before that activity, so the link rests on shared tooling rather than a matching timeline. We covered the Korean bank breaches and Microsoft's Storm-0940 attribution separately.

123 Reg has reported the incident to law enforcement, brought in outside incident response support, and notified the US Federal Trade Commission and data protection authorities in the UK and EU.

What 123 Reg customers should do

The biggest risk now is phishing that knows your account. A message that greets you by name, mentions the exact domain or hosting plan you hold and quotes your preferred currency is far more believable than a generic scam. The likely lures are domain renewal and expiry notices, "verify your account" emails, payment failure warnings and phone calls from "123 Reg support".

1. Turn on two-step verification (2SV) on your 123 Reg account today. The company "strongly recommends" it. Use an authenticator app or security key rather than SMS where your account offers the choice, since your phone number is one of the exposed fields.
2. Never act on a link or a call. Log in by typing the 123 Reg address yourself and check any renewal or payment notice there. 123 Reg says it will never ask for passwords, verification codes or payment details by email, text or phone.
3. Check the lock status of every domain. For .com, .net, .org and most other generic domains, a public WHOIS or RDAP lookup should show clientTransferProhibited; if it does not, turn the transfer lock on in the account. .uk domains move between registrars when the IPS tag (Nominet's registrar code) is changed at the current registrar, so for them the protection is control of the 123 Reg login itself.
4. Review the account's contact email, users and payment cards. Confirm the account email goes to a monitored role mailbox, not one person's inbox, and remove anyone who no longer needs access.
5. Warn whoever pays the bills. Finance and office staff are the people a fake renewal notice is aimed at. Tell them domain renewals are only ever paid inside the account.

WHOIS privacy is worth having on any domain that allows it, but it would not have helped here: the leaked fields came from 123 Reg's customer records, not from the public WHOIS database.

Check whether anything has already happened

Look at the account's login history and recent changes for anything since September 18: new users, changed contact email, nameserver or DNS record edits, and domains unlocked or with a changed IPS tag. For a domain you rely on for email, compare its current MX and nameserver records with what you expect. If anything changed that you did not do, reset the password, re-enrol 2SV and contact 123 Reg through the account.

The wider lesson for anyone running an API

The fields in this leak are the ones a customer lookup API returns. If your own platform exposes per-customer records through an API, test it the way an automated agent would: a valid session asking for other customers' IDs in sequence, at volume, over hours. Rate limits per key, an authorisation check on every object, and an alert when one client touches far more distinct customer records than normal would each have made a bulk read like this slower or louder.

Our attack surface management work finds the APIs and admin interfaces you expose, and web penetration testing checks whether one account can read another's records. Open the chat and Yaali, our AI agent, will pass your question to an engineer.

---

Sources: Let's Data Science, Results Sense, Daily Security Review, Diario Bitcoin, The Register on GTG-1002, AWS Route 53 transfer statuses, IONOS on IPS tags.