123 Reg discloses 'AI cyberattack' on customer data, suspects China nexus
Company chiefs believe the attackers could be the same as those who used ARTEX to breach South Korea’s financial giants
123 Reg, a UK domain registrar, disclosed that it suffered an AI-driven cyberattack compromising customer data. Customers received notification emails revealing exposure of contact information, customer relationship data, VAT numbers, and product information from an application programming interface (API). The September 18 intrusion marked the first known AI-driven cyberattack against the company.
Early signs pointed to a China-nexus attacker, with identified IP addresses hosted in China and Singapore. The investigation revealed AI cyberattack skills hosted on Chinese infrastructure, including open-source scripts from Anthropic and other AI exploitation frameworks. Many artifacts led the company to suspect a Chinese state-sponsored group, possibly involved in attacks against over 30 organizations.
The TA mirror of anthropic_skills and account naming conventions on Chinese servers further supported this suspicion. CrowdStrike reported a similar attack by an unknown actor targeting South Korean financial organizations in late September 2026, aligning with the timeline of the 123 Reg attack. The attacker used ARTEX, an open-source Chinese-developed tool released in July 2026, also observed in the 123 Reg breach.
Law enforcement was notified, and the registrar worked with ISPs to shut down the attacker's servers in the region. 123 Reg advised customers to remain vigilant and not to share sensitive information.
Written by urgent.news from The Register's reporting — not their text. Machine-written — may contain errors; check the original before relying on it.
