123 Reg Points Finger at China After 'AI-Driven' Attack Leaks Customer Data
UK domain registrar 123 Reg has told customers their data was compromised in what it's calling an AI-driven cyberattack, with early forensic work pointing toward a Chinese state-sponsored threat actor.
Notification emails landed in customer inboxes this week. The exposed data includes names, phone numbers, country and language settings, currency preferences, account creation dates, product information pulled from an API, VAT numbers, and marketing preferences. Not the most sensitive haul imaginable, but enough to fuel convincing phishing campaigns.
The breach itself dates to 18 September. 123 Reg describes it as the first AI-assisted attack the company has faced, which is either a meaningful distinction or useful marketing copy depending on your level of cynicism.
On the China attribution: the company says its investigation traced core attacker infrastructure to IP addresses hosted in China and Singapore. More interesting is what else turned up on those servers. Investigators found what they're describing as AI attack 'skills,' including copies of tools originally open-sourced by Anthropic, alongside various exploitation frameworks and scripts.
The naming conventions found on the Chinese servers, and a mirrored repository labelled 'anthropic_skills,' apparently match patterns associated with a known group suspected of abusing Claude Code in attacks against at least 30 other organisations.
123 Reg also draws a line between its attackers and a separate incident flagged by CrowdStrike on 7 October, in which an unknown, likely Chinese-speaking actor targeted several South Korean financial institutions starting in late September. That campaign used ARTEX, an open-source agentic penetration-testing tool developed in China and released in July. The same tool, 123 Reg says, was observed during its own breach.
The timeline overlap and shared tooling are suggestive, though attribution in cybersecurity is rarely clean. 'Likely Chinese-speaking' and 'Chinese state-sponsored' are doing a lot of work here, and the company is presumably relying heavily on CrowdStrike's analysis rather than drawing its own geopolitical conclusions.
On the damage: the attacker appears to have read customer data rather than deleted or modified it. Whether copies were made is unknown, which is precisely why 123 Reg felt obliged to notify affected users.
The company has reported the incident to law enforcement, the FTC, and data protection authorities in both the UK and the EU. It also worked with Singaporean ISPs to take down attacker infrastructure in the region.
Customers are being advised to enable two-step verification, be suspicious of any unsolicited contact claiming to be from 123 Reg, and remember that the company will never ask for passwords, payment details, or verification codes over email, text, or phone.
Standard breach advice, in other words. The AI angle is genuinely novel, but the phishing risk it creates is entirely conventional.