Case 123-reg-ai-cyberattack-customer-dataState actor AI opsUnited Kingdom
123 Reg discloses AI cyberattack on customer data, suspects China nexus
UK registrar 123 Reg (GoDaddy-owned) disclosed that a 18 September 2026 intrusion, which it calls its first known AI-driven cyberattack, exposed customer contact details, VAT numbers and product data from an API; the company says activity was limited to reading data and alleges a China nexus, suspecting a Claude Code-abusing state-linked group or the actors who used ARTEX against South Korean financial firms.
HighAttack using AIStatus: Under investigationVerified case file
Open in the interactive mapCite this case
- Reported
- Oct 28, 2026
- Location
- United Kingdom
- Target
- 123 Reg customer contact and product data
- Severity
- High
- Verification
- Reported by credible press or researchers
- Triggered by
- Unknown (alleged China-nexus; possibly the ARTEX actors, per the company)
- Actor type
- Unknown
- Sector
- Technology & AI vendors
- Reported loss
- None reported
- CVE
- None
What happened
UK registrar 123 Reg (GoDaddy-owned) disclosed that a 18 September 2026 intrusion, which it calls its first known AI-driven cyberattack, exposed customer contact details, VAT numbers and product data from an API; the company says activity was limited to reading data and alleges a China nexus, suspecting a Claude Code-abusing state-linked group or the actors who used ARTEX against South Korean financial firms.
Impact: Customer data was affected. The scope and number of customers are not stated in the summary.
Who triggered it
Actor: Unknown (alleged China-nexus; possibly the ARTEX actors, per the company)
Attribution: 123 Reg leadership suspects a China nexus and a possible link to the ARTEX attackers (per The Register); not confirmed.
Motive: Unknown
How it happened
Attack vector: Described as an AI-driven cyberattack; the exact method is not stated.
Root cause: Unknown
Timeline
- Reported by The Register
Response
123 Reg publicly disclosed the incident.
Current status: Under investigation
Research warnings this case matches
- Seen in real incidents AI makes cyberattacks easier, faster and larger · CAIS
- Seen in real incidents Criminals and state hackers use AI in cyberattacks · International AI Safety Report
- Seen in real incidents Malicious actors and misuse · MIT AI Risk Repository
Compared with published AI risk research from several institutes on the Research vs reality page.
Sources (open in a new tab)
- The Register theregister.com
- Resultsense resultsense.com
Cite this case
123 Reg discloses AI cyberattack on customer data, suspects China nexus. AI Threat Watch, case 123-reg-ai-cyberattack-customer-data, Oct 28, 2026. https://aithreat.io/cases/123-reg-ai-cyberattack-customer-data/
Permanent link: https://aithreat.io/cases/123-reg-ai-cyberattack-customer-data/
Related cases
The same type of incident, most recent first.