UK domain registrar 123 Reg has told customers that an intrusion on 18 September 2026 exposed their contact and account details. The company calls it "the first known AI-driven cyberattack against our company" and has notified UK and EU data protection authorities.
What was exposed. According to the notification emails, the data includes company VAT numbers, customer names and phone numbers, the date each account was opened, the products an account holds, country, preferred language and currency, and marketing choices. 123 Reg says the attacker only read the data but concedes that copies may have been made. Corporate VAT numbers and product data reached through its APIs were also targeted.
Attribution. A spokesperson told The Register that the attackers' core servers were in China and Singapore and held copies of AI attack "skills", including ones Anthropic had open-sourced. 123 Reg links the intrusion to ARTEX, an open-source AI penetration-testing tool developed in China. The company says the timing and methods overlap with a campaign against South Korean financial firms, but it has not confirmed that the same group is responsible. The attribution comes from 123 Reg itself and has not been independently confirmed.
What customers should do. 123 Reg advises customers to be wary of calls or messages that appear to come from it, to log in only directly through its website and to switch on two-step verification. The company says it will never ask for passwords, verification codes or payment details.
Sources: Resultsense, 29 Oct 2026 (via The Register); The Register, 28 Oct 2026; Seoul Economic Daily, 30 Oct 2026