UK domain registrar 123 Reg has told customers that an attack on 18 September exposed their contact and account information, describing it as the first known AI-driven cyberattack against the company. Customers began receiving notification emails in the week of 26 October, about six weeks after the intrusion, according to reporting of the company's notice.

What was not reported as taken

The exposed information included names and phone numbers, countries, language and currency preferences, account creation dates, the products held on each account, and marketing preferences, the company told The Register. Company VAT numbers and related customer relationship data were also listed, along with product information taken from an application programming interface.

Attribution remains the company's assessment

The customer notice did not mention passwords or payment details being taken. 123 Reg said the attacker's activity was limited to reading data, although a spokesperson acknowledged that copies may have been made, which is why customers were warned. Even without passwords, a name, phone number, business details and product list can make a phishing message look convincing. 123 Reg told The Register that attacker infrastructure hosted in China and Singapore pointed to a strong Chinese nexus, and that AI attack "skills" found on that infrastructure included copies of skills open-sourced by Anthropic and other frameworks. The company also suspects a link to a group associated with the ARTEX tool, linked to attacks on South Korean financial institutions. Those links are the company's own assessment so far; no technical report has been published to confirm them. Customers are advised to be wary of unexpected calls or messages claiming to be from 123 Reg, to log in only through the company's own website, and to switch on two-step verification.

Sources: The Register, ResultSense.