TL;DR
123 Reg, the UK domain registrar, has told customers that an intrusion on 18 September exposed their contact and account details, and calls it “the first known AI-driven cyberattack against our company”. A spokesperson told The Register that the attackers’ servers were in China and Singapore and held copies of AI attack “skills”, including ones Anthropic had open-sourced. The company has notified UK and EU data protection authorities.
What was taken
The notification emails, which customers began receiving shortly before The Register’s 28 October report, list company VAT numbers and contact details as exposed. The spokesperson spelled out the rest: customer names and phone numbers, when each account was opened and which products it holds, plus country, preferred language and currency, and marketing choices. 123 Reg says the attacker only read the data, but concedes copies may have been made, which is why it is warning customers.
Its advice is to be wary of any call or message that appears to be from 123 Reg, log in directly through its website, and switch on two-step verification. 123 Reg, which GoDaddy owns, says it will never ask for passwords, verification codes or payment details.
The AI evidence
The spokesperson said investigators traced the attackers’ core servers to Singapore and China. On the Chinese servers they found AI-powered attack tooling: the copied Anthropic skills plus several other exploit kits and scripts. Artefacts left behind pointed, in the company’s view, to a Chinese state-sponsored group previously linked to misuse of Claude Code against at least 30 organisations.
123 Reg also links the intrusion to ARTEX, an agentic penetration-testing tool developed in China and released as open source in July. On 7 October CrowdStrike published an advisory about a probably Chinese-speaking actor that used ARTEX against South Korean financial firms from late September, a period 123 Reg says overlaps with its own attack.
A wider pattern
The incident fits findings CrowdStrike published on 28 October about the legal sector. Reuters reports that its legal threat report counted 455 law firms and legal bodies named on leak sites in the year to August, 39% more than the year before, with attacks doubling since 2023. “More and more threat actors are using agentic technology to democratize hacking,” said Adam Meyers, who leads its counter-adversary work. The report names no victims, and the recent breaches Reuters lists alongside it are at US firms, but it identifies China-linked groups as the biggest intelligence threat to the sector.
Looking Forward
The attribution comes from 123 Reg itself and has not been independently confirmed. Even so, in our view this is a notable disclosure: a UK registrar publicly describing an attack built from openly available AI agent tooling. For small businesses that hold domains with 123 Reg, the practical steps are the ones it lists: stay alert to misuse of the leaked details, and turn on two-step verification.