123 Reg says an AI-driven attack exposed customer contact and account data
What happened
UK domain registrar 123 Reg told customers that an attack it describes as AI-driven on 18 September exposed contact details and account information. The company suspects a China-linked actor and says it reported the incident to authorities.
Per The Register, the exposed data included names, phone numbers, countries, language and currency settings, account creation dates, VAT numbers, products and marketing preferences, obtained through an API. The customer email says activity was limited to reading, though a spokesperson said copies may have been made. The company found attacker infrastructure in China and Singapore, along with AI attack skills hosted on Chinese servers, including copies of skills published as open source by Anthropic. It suspects the group behind ARTEX attacks on South Korean financial institutions, which is a suspicion and not an attribution.
How it happened
AI-run attack: Autonomous intrusion. The attacker's own AI agent carried out the break-in, working through the steps with little human involvement.
Sources do not say whose AI model was involved. The product type was AI agent.
Impact
Data was exposed. Data involved: personal data. The impact was confined to one organization and its users or customers.
Severity is rated Medium, calculated from how far the incident reached and how sensitive the data was.
Was the AI at fault?
No. The failure was in the systems, settings or people around the AI, not in the model's behaviour.
Status and timeline
Reported in the press or by researchers, but not confirmed by the affected organization, the AI vendor or a regulator.
It happened or began on 18 Sep 2026. It became public on 28 Oct 2026, 40 days later.
123 Reg emailed affected customers, reported the attack to law enforcement, hired outside security support, notified regulators in the US, UK and EU, and worked with Singapore-based providers to take attacker servers down. It advised customers to watch for misuse and enable two-step verification.