{
  "id": 16893554,
  "title": "123 Reg discloses 'AI cyberattack' on customer data, suspects China nexus",
  "url": "https://urgent.news/2026/10/28/123-reg-discloses-ai-cyberattack-on-customer-data-suspects-china-nexus",
  "topic": "ai",
  "section": "AI",
  "published": "2026-10-28T11:45:00.000Z",
  "source": {
    "name": "The Register Science",
    "slug": "the-register-science",
    "url": "https://www.theregister.com/cyber-crime/2026/10/28/123-reg-discloses-ai-cyberattack-on-customer-data-suspects-china-nexus/5305936"
  },
  "original_language": "en",
  "account": "123 Reg, a UK-based domain registrar, disclosed on September 18 that it suffered an AI-driven cyberattack exposing sensitive customer data. Customers were notified via email that their contact information, customer relationship data, company VAT numbers, and product information were compromised. The company spokesperson stated this marks the first known AI-driven cyberattack against 123 Reg. Early investigations identified IP addresses hosted in China and Singapore as the core infrastructure, indicating a strong Chinese connection. The investigation also found evidence of AI cyberattack skills hosted on Chinese infrastructure, including copied materials from Anthropic and other AI exploitation frameworks. The spokesperson suspected a Chinese state-sponsored group, known for targeting at least 30 organizations with Claude Code, may be responsible. This group is also suspected of attacking several South Korean financial institutions using the open-source Chinese AI tool ARTEX. CrowdStrike reported on October 7 that an unknown, likely Chinese-speaking actor behind the South Korean attacks used ARTEX, a Chinese-developed agentic penetration-testing tool released in July 2026. 123 Reg reported the incident to law enforcement, hired outside cybersecurity support, and notified FTC and data protection authorities in the UK and EU. The company stated the attack was limited to reading customer data, though copies could have been made. They urged customers to remain vigilant for potential misuse of their data and to verify any suspicious communications with the company directly through their website. 123 Reg also recommended enabling two-step verification to protect accounts from such attacks.",
  "summary": "Company chiefs believe the attackers could be the same as those who used ARTEX to breach South Korea’s financial giants",
  "key_points": [],
  "editors_take": null,
  "illustration": null,
  "coverage": {
    "outlets": 1,
    "also_reported_by": []
  },
  "ai_generated": true,
  "disclaimer": "Summaries, key points and the editor’s take are written by software from other outlets’ reporting and may contain errors — always check the linked original."
}