UK domain registrar 123 Reg (owned by GoDaddy) is emailing customers about what it calls “the first known AI-driven cyberattack against our company,” an intrusion on Sept. 18.
What was exposed
Names, phone numbers, countries, language and currency preferences, account creation dates, products on the account, marketing preferences, company VAT numbers and product information from an API. The company says the attacker was “limited to reading” the data but may have made copies.
Who it suspects
123 Reg says the core attacker servers were in China and Singapore, and it found AI attack “skills” on Chinese infrastructure, including copies of skills Anthropic open-sourced. It suspects a Chinese state-sponsored group, possibly the one CrowdStrike tied to attacks on South Korean financial firms using the open-source agentic pentest tool ARTEX. It reported the attack to law enforcement, the FTC and UK and EU data regulators.
Checklist if you’re a customer
- Expect phishing that uses your real details. If a call or email seems off, go to the website yourself and log in.
- 123 Reg says it will never ask for your password, payment details or codes by email, text or phone.
- Turn on two-factor authentication, and lock your domains with a registrar lock.
God Bless, and Needs Garlic!
