Customers of 123 Reg started receiving breach notifications this week, three weeks after an intrusion the GoDaddy-owned registrar now describes as “the first known AI-driven cyberattack against our company.”
The compromised material is broad but not deep. Names, phone numbers, countries, language and currency preferences, account creation dates, subscription products and marketing preferences were all readable. Company VAT numbers and data pulled from an internal API also left the estate. Passwords were not taken.
Investigators traced the intrusion to infrastructure hosted in China and Singapore, which the company reads as a strong Chinese nexus. On those servers sat exploit tooling including mirrors of agent “skills” that Anthropic published as open source.
Two possible culprits
The naming conventions and artifact layout left 123 Reg weighing two actors. One is a Chinese state-linked crew already known for abusing Claude Code against at least 30 organizations. The other is the group that used ARTEX, an agentic penetration-testing framework released in China in July 2026, to hit South Korean financial institutions from late September.
That second theory rests on timing as much as code. CrowdStrike’s CSA-261162 advisory, published October 7, described an unknown but likely Chinese-speaking operator running ARTEX against Korean finance targets during the same window 123 Reg was breached.
Containment and next steps
The registrar notified the Information Commissioner’s Office, European data protection authorities and the Federal Trade Commission, and worked with Singaporean providers to shut the attacker’s servers down. Customer email said activity “was limited to reading,” though a spokesperson conceded copies may exist.
Affected customers should assume their contact details will be reused in follow-on calls and messages. 123 Reg says it will never request a password, payment card or verification code, and is pushing two-step verification across the customer base.
