UK Domain Registrar 123 Reg Reports AI-Driven Attack Exposing Customer Data

UK domain registrar 123 Reg has told customers it suffered what it calls its first known AI-driven cyberattack. Notification emails went out this week. The company says the exposed data included contact information, related customer relationship data, company VAT numbers and product information from an application programming interface (API). A spokesperson said this covers names, phone numbers, countries, language and currency preferences, account creation dates, the products on each account, and marketing preferences.

The company says early signs point to a China-nexus attacker. Its investigation found IP addresses it assessed to be core attacker infrastructure, hosted in China and Singapore. It also found AI attack "skills" on Chinese infrastructure, including copies of skills open sourced by Anthropic and several other AI exploitation frameworks and scripts. 123 Reg suspects a Chinese state-sponsored group, known for abusing Claude Code against at least 30 organisations, may be responsible.

The company also suspects the same group targeted South Korean financial institutions using ARTEX, an open-source Chinese-developed agentic penetration-testing tool released in July 2026. It points to a CrowdStrike report, CSA-261162, which describes a likely Chinese-speaking actor active from late September 2026, the same period as its own incident. These links are the company's assessment, not confirmed attribution. This summary is based on the opening of the original article only.