UK domain registrar 123 Reg and its parent GoDaddy are telling customers that an intrusion in September, which they describe as AI-driven, exposed contact, account and business data. GoDaddy says no passwords were taken, but for the small firms that rely on 123 Reg, the leaked details are exactly what a convincing phishing campaign needs.
What happened
This week, customers of 123 Reg, one of the UK’s best-known registrars for small business domains and websites, started receiving breach notification emails. The company told The Register that the intrusion happened on 18 September. It called the incident “the first known AI-driven cyberattack against our company”. GoDaddy, which owns 123 Reg, sent its own notice to customers of its Websites + Marketing product. That notice says the activity was spotted the day after it started.
123 Reg’s email refers to contact and relationship data, business VAT numbers and product details read through an application programming interface. A spokesperson told The Register that this covers:
- names and phone numbers
- country, language and currency preferences
- the date each account was created
- the products held on each account
- marketing preferences
GoDaddy’s notice adds profile, settings and contact details linked to Websites + Marketing, including contact information that customers had chosen to publish on their own sites.
GoDaddy says no passwords were obtained, no customer accounts were accessed and there is no sign that websites were altered. Both companies describe the attacker’s activity as limited to reading data. However, the 123 Reg spokesperson conceded it is possible the attacker made copies of what it read, and said that possibility is why customers are being told. Neither company has said how many people are affected.
123 Reg says it called in outside responders and reported the attack to police, the US FTC and UK and EU privacy regulators, which for a British registrar would normally mean the Information Commissioner’s Office.
The technical picture
Little technical detail has been published. The notices name an API as the route, but do not say whether the attacker abused a flaw, used stolen credentials or found an endpoint returning more data than it should. On what is known, this was read-only bulk extraction, not account compromise.
The attribution claims come from 123 Reg alone, as reported by The Register. The company says the IP addresses it considers core attacker infrastructure were hosted in China and Singapore. On that infrastructure it found what it calls AI cyberattack “skills”, among them copies of skills that Anthropic has open sourced, alongside other AI exploitation frameworks and scripts. It also says it saw the ARTEX agentic penetration testing tool being used in the attack.
From those artefacts, 123 Reg suspects a Chinese state-sponsored group previously linked to misuse of Claude Code against at least 30 organisations. It also links the attack to the actor behind a campaign against South Korean financial firms from late September. That second link rests on timing and on the shared use of ARTEX. CrowdStrike, which documented the Korean activity in early October, judged that actor with moderate confidence to be a financially motivated Chinese speaker. It did not attribute the activity to a named adversary. Open-source tooling can be picked up by anyone, so a shared tool is a lead, not proof of a shared actor.
123 Reg also says it worked with Singapore ISPs to take the attacker’s servers there offline, which helped disrupt the attack.
Why it matters for UK organisations
The customer base makes this matter more than the data categories suggest. Many of 123 Reg’s customers are sole traders and small firms, for whom the registrar account controls their domain, email routing and website. Names, phone numbers, VAT numbers, products held and account age let a fraudster write a very plausible message, such as a renewal warning for a domain the victim really owns, quoting the exact product they pay for.
The real prize is the registrar login that this data can help steal. Whoever controls a registrar account can change name servers or MX records, quietly redirecting email, intercepting password resets or putting up a cloned website. A small firm without an IT team may not notice for days.
There is a regulatory angle too. Under UK GDPR, a notifiable breach must reach the ICO within 72 hours, and high-risk breaches must be communicated to the people affected without undue delay. 123 Reg says it told regulators, but customers are hearing about it more than five weeks after the intrusion. Do not assume a supplier’s breach will reach you quickly.
Expert view
The “AI-driven” label will grab the headlines, and I would treat it carefully. Nothing disclosed suggests a new kind of attack: an API was queried and data was read. AI tooling probably speeds up the tedious parts, such as enumerating endpoints and writing scrapers. But a weakness that lets an outsider pull customer records through an interface is just as exploitable by a patient human with a script.
When we test web platforms, APIs are where the problems usually sit: object-level authorisation gaps, responses carrying far more fields than the front end shows, and missing rate limits that allow records to be harvested one request at a time. In my experience these survive for years because nobody inspects the raw responses. What agentic tools change is speed. They shorten the time between a weakness going live and its data leaving the building.
The attribution deserves the same caution. Sharing infrastructure clues is reasonable, but 123 Reg’s state-sponsored theory goes further than CrowdStrike’s view of the Korean actor. Until an independent investigation is published, the lesson for defenders is the access route, not the attacker’s nationality.
What to do now
- Turn on two-step verification for every registrar and hosting account, as 123 Reg recommends, preferably with an authenticator app rather than SMS. This meets the Cyber Essentials user access control requirement for cloud services.
- Warn staff about registrar-themed phishing. Treat renewal, suspension or verification messages mentioning 123 Reg or GoDaddy as suspect and log in directly instead of following links. The company says it never asks for passwords, payment details or codes.
- Check your domain configuration. Confirm name servers, MX, SPF, DKIM and DMARC records are as expected, enable transfer lock, and turn on DNS change alerts if offered.
- Tidy up account ownership. Register domains to a monitored role mailbox and remove users who no longer need access, in line with Cyber Essentials least privilege.
- Review your own APIs for authorisation flaws and over-generous responses, and add rate limiting and monitoring for bulk reads.
- Update supplier risk records and ask which of your data fields were exposed.
Bottom line
The data taken from 123 Reg and GoDaddy is not catastrophic in itself, but it is ideal raw material for targeted fraud against small UK businesses whose domains underpin their email and websites. Lock down registrar accounts with strong second factors, check your DNS, and treat the AI label as a reminder that weak APIs are now found and drained faster than before.
