"the first known AI-driven cyberattack against our company," 123 Reg told customers and reporters as it disclosed a September intrusion that exposed a range of customer data.
What 123 Reg says was taken
The GoDaddy-owned registrar said customers began receiving notification emails this week after an intrusion on September 18. The company’s message said the attacker’s activity "was limited to reading" certain records, although the spokesperson added "it's possible they created copies of the information," and that possibility prompted the notifications.
According to 123 Reg, the compromised fields include contact information and "related customer relationship data," company VAT numbers, and "product information from an application programming interface (API)." A company spokesperson clarified that this encompasses names, phone numbers, countries, language and currency preferences, account creation dates, the products on the account, and marketing preferences.
Investigation findings: IPs, AI 'skills', and artefacts
123 Reg described the incident as an "AI-driven cyberattack" and said its investigation turned up server infrastructure and software artefacts that pointed to a China nexus. "Our investigation identified IP addresses that we assessed to be the core attacker infrastructure, which were hosted in China and Singapore, indicating a strong Chinese nexus," the spokesperson said.
The company also reported finding AI cyberattack "skills" hosted on Chinese infrastructure, including "copies of skills open sourced by Anthropic and several other AI exploitation frameworks and scripts." 123 Reg said these artefacts helped form the assessment that the attack used AI-augmented tooling rather than purely manual techniques.
This site is the portfolio.
OSINTSights runs on Cloudflare Workers, D1, R2, and Vectorize, with an AI pipeline on Hetzner ARM. Nubivance designed, built, and operates it. We do the same for clients.
See what we buildLinks to groups that abused Claude Code and ARTEX
123 Reg said "many of the artefacts left behind led [us] to suspect that a Chinese state-sponsored group, known for abusing Claude Code in attacks against at least 30 organizations, could be behind the break-in." The registrar further noted overlaps with a suspected actor tracked by CrowdStrike.
On October 7, 2026, CrowdStrike published advisory CSA-261162 describing an unknown, likely Chinese-speaking actor that targeted several South Korean financial organizations starting in late September 2026. 123 Reg said that actor used ARTEX, an open-source Chinese-developed agentic penetration-testing tool released in July 2026, and that ARTEX "was also observed to be used in the attack that targeted us." 123 Reg added that the TA's mirror of "anthropic_skills," and account naming conventions on the Chinese servers "are consistent with preparation of this class of AI-augmented operation."
Containment, reporting, and disruption steps
The registrar reported the incident to law enforcement, engaged outside cybersecurity support, and notified the U.S. Federal Trade Commission as well as the data protection authorities in the UK and the EU. 123 Reg said it worked with Singapore-based ISPs to shut down the attacker’s servers in that region, and that those takedown efforts "helped disrupt the attack," alongside "other actions by us and industry partners."
Beyond takedowns and investigation, the company urged vigilance among users. The notification email instructed customers: "If you receive a message or call and aren't sure it's from 123 Reg, go directly to our website and log in." The registrar warned it "will never contact you to request your password, payment details, or verification codes by email, text, or phone," and "strongly recommend[d] turning on two-step verification (2SV), which helps keep your account protected even if someone tricks you into sharing your password."
What this means for customers, registrars, and investigators
- Customers: 123 Reg told account holders to treat communications purporting to be from the company with caution, to log in via the website rather than follow links or respond to unexpected messages, and to enable 2SV using instructions available in their account.
- Registrars and hosting providers: The incident highlights the operational impact of agentic AI tooling and the need to cooperate with ISPs and outside cybersecurity firms; 123 Reg credited Singapore-based ISP takedowns and outside support with disrupting the campaign.
- Incident responders and threat intelligence teams: 123 Reg’s report points responders to specific indicators and artefact classes—IP infrastructure in China and Singapore, copies of "anthropic_skills," ARTEX usage, and account-naming conventions—that influenced its attribution and containment steps.
123 Reg acknowledged the disruption and apologised to customers. The company’s published details outline a pattern: an intrusion on September 18, artefacts and infrastructure hosted in China and Singapore, overlap with publicly reported activity in late September against South Korean financial organizations, and reliance on open-source AI tooling such as ARTEX and copies of Anthropic skills. The registrar has moved through reporting, takedown and notification; what remains is close scrutiny by regulators and affected customers of any downstream misuse if copies of the read data were retained.
