123 Reg discloses an AI driven cyberattack on customer data. What to do if your domain is with them
The UK domain registrar says an intrusion in September exposed names, phone numbers, VAT numbers and the products on customer accounts. It is warning customers to be wary of messages that appear to come from it.
123 Reg, the UK domain registrar owned by GoDaddy, has told customers that it was the victim of what it calls an AI driven cyberattack that exposed customer data, The Register reported on 28 October. Customers began receiving notification emails in the week of 26 October. If your business registered a domain or bought hosting through 123 Reg, check your inbox for that email and read on.
What was exposed
According to the notification emails, contact information, related customer relationship data, company VAT numbers and product information from an application programming interface were compromised. A company spokesperson told The Register this means names, phone numbers, countries, language and currency preferences, account creation dates, the products on the account and marketing preferences. 123 Reg's email said the attacker's activity was limited to reading customer data, but the spokesperson said it is possible the attacker made copies, and that this is what prompted the notification.
What 123 Reg says happened
123 Reg described the intrusion, on 18 September, as the first known AI driven cyberattack against the company. Its spokesperson said the investigation found the attacker's core infrastructure was hosted in China and Singapore, indicating a strong Chinese nexus, and found AI attack tools on that infrastructure. The company says it suspects a link to activity CrowdStrike described against South Korean financial organisations in the same period, which used an open source agentic penetration testing tool called ARTEX. 123 Reg says it reported the attack to law enforcement, brought in outside cyber security support, notified the data protection authorities in the UK and EU, and worked with ISPs in Singapore to shut down the attacker's servers there.
What 123 Reg is telling customers
The registrar urged customers to stay alert to misuse of their data and to treat communications that appear to come from 123 Reg with caution. Its email says that if you receive a message or call and are not sure it is from 123 Reg, you should go directly to its website and log in, and that it will never contact you to ask for your password, payment details or verification codes by email, text or phone. It also strongly recommends turning on two step verification, which it says helps protect your account even if someone tricks you into sharing your password.
What this means for your business
The details taken are the raw material for a convincing scam: your name, your phone number and which products you hold. Expect emails, texts or calls about domain renewals, hosting problems or unpaid invoices that look entirely plausible. Agree a simple rule with your team: nobody acts on a message about your domain or website from a link or a phone call, they log in to the account directly instead. Turn on two step verification on your 123 Reg account, as the company recommends, and while you are there check who has access and that the contact email is one your business still controls. Losing control of a domain can take your website and email with it. If you are in Exeter or the wider South West and are not sure where your domains are registered or who can manage them, we can help you find out.
#WEARECOBALT
Ready when you are.
Tell us what's slowing your business down. We'll tell you exactly how we'd fix it — plainly, with no obligation.