123 Reg Discloses AI-Driven Cyberattack Linked to China-Nexus Actor
UK domain registrar 123 Reg has revealed an AI-driven cyberattack that exposed customer data, with early indicators pointing to a China-nexus threat actor utilizing advanced AI exploitation frameworks.
UK domain registrar 123 Reg has disclosed that it was the target of an "AI-driven cyberattack" which resulted in the compromise of customer data. Customers were notified this week that their contact information, "related customer relationship data," company VAT numbers, and "product information from an application programming interface (API)" were exposed. The affected data includes names, phone numbers, countries, language and currency preferences, account creation dates, products associated with the account, and marketing preferences.
123 Reg characterized the September 18 intrusion as "the first known AI-driven cyberattack against our company." Initial findings from the investigation suggest a China-nexus attacker was responsible. The company stated, "Our investigation identified IP addresses that we assessed to be the core attacker infrastructure, which were hosted in China and Singapore, indicating a strong Chinese nexus."
Further analysis of the attacker's methods revealed the use of sophisticated AI capabilities. "Our investigation further identified AI cyberattack 'skills' hosted on Chinese infrastructure, including copies of skills open sourced by Anthropic and several other AI exploitation frameworks and scripts," a spokesperson explained. The nature of the digital artifacts left behind led 123 Reg to suspect a connection to a Chinese state-sponsored group known for exploiting AI tools, potentially the same actor that targeted South Korean financial institutions using the open-source AI tool ARTEX.
The spokesperson elaborated on the similarities, noting, "The TA's mirror of 'anthropic_skills,' and the account naming conventions found on the Chinese servers are consistent with preparation of this class of AI-augmented operation." Additionally, a CrowdStrike report from October 7, 2026, detailed an actor, likely Chinese-speaking, targeting South Korean financial organizations with ARTEX during the same period as the 123 Reg attack.
In response to the incident, 123 Reg has taken several measures. The company reported the attack to law enforcement agencies, engaged external cybersecurity experts, and notified regulatory bodies including the FTC, and data protection authorities in the UK and EU. Working with Singapore-based ISPs, 123 Reg managed to shut down the attacker's servers in the region, which helped disrupt the ongoing attack, alongside other industry partner actions.
While 123 Reg initially stated the attacker's activity was limited to reading data, the spokesperson acknowledged that "it's possible they created copies of the information," prompting the customer notifications. The registrar has advised customers to remain vigilant for potential data misuse and to exercise caution with any communications purporting to be from the company. Customers are urged to verify communications by visiting the 123 Reg website directly and are reminded that the company will never request passwords, payment details, or verification codes via email, text, or phone.
The company strongly recommends enabling two-step verification (2SV) as an additional security measure to protect accounts, even if credentials are compromised. Instructions for setting up 2SV are available within the 123 Reg account portal. 123 Reg has apologized for any inconvenience caused by the incident.