123 Reg says AI-driven attack exposed customer contact and account data
Original title: 123 Reg discloses 'AI cyberattack' on customer data, suspects China nexus
The GoDaddy-owned registrar says the September 18 intrusion was limited to reading and suspects China-linked use of ARTEX.
UK registrar 123 Reg told customers an intrusion on September 18 exposed names, phone numbers, VAT numbers, preferences and product data from an API. The company says activity was limited to reading, though copies may exist, and it notified law enforcement, the FTC and UK and EU data authorities. Investigators cite China- and Singapore-hosted infrastructure and AI tooling, including ARTEX; that link is the company's assessment.
Unconfirmed: A China nexus and a link to the South Korea ARTEX attacks are 123 Reg's suspicion, not confirmed attribution.
- Customers began receiving notification emails this week.
- Exposed fields include language, currency, account dates and marketing preferences.
- 123 Reg cites Chinese-hosted copies of Anthropic-published AI skills.
- CrowdStrike CSA-261162 describes a late-September ARTEX campaign against South Korean finance.
- The company advises two-step verification and caution with unexpected contact.
Impact: Customer contact, VAT and product data exposed
- 1.Turn on two-step verification in the 123 Reg account.
- 2.Do not share passwords, payment details or codes by email, text or phone.
- 3.If a message seems suspicious, open the 123 Reg site directly and log in.
- Vendors
- GoDaddy
- Malware
- ARTEX
- Victims
- 123 Reg
- Organizations
- AnthropicCrowdStrikeFTC
- AI models
- Claude Code
From the original article
3 min read at theregister.comCompany chiefs believe the attackers could be the same as those who used ARTEX to breach South Korea’s financial giants
By Connor Jones · theregister.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.