EXPLORINEER
en

UK — The Register

123 Reg discloses 'AI cyberattack' on customer data, suspects China nexus

Security2 min read

UK domain registrar 123 Reg says hackers used AI tools to break in and expose customer data. The company thinks a China-linked group may be behind the attack.

What happened

123 Reg, a UK company that helps people register website names, says it was hit by an "AI-driven cyberattack". The break-in happened on September 18. Customers started getting emails this week telling them their data was exposed. The company says the attacker could read customer data and may have made copies of it.

Key facts

  • The attack was on September 18, 2026.
  • Data affected includes names, phone numbers, countries, language and currency settings, account creation dates, products on the account, and marketing choices.
  • Company VAT numbers (tax ID numbers for businesses) were also affected.
  • The attacker used IP addresses (internet addresses) hosted in China and Singapore.
  • A known Chinese state-linked group may have used Claude Code in attacks on at least 30 organizations.

Why China is suspected

123 Reg says the attack tools and servers point to China. The company found copies of AI attack "skills" (small sets of instructions for AI tools) on Chinese servers. These included copies of skills first shared by Anthropic, an AI company. The company also thinks the same group may have attacked South Korean banks and financial firms using ARTEX, an open-source Chinese AI tool for testing computer security. Cybersecurity firm CrowdStrike reported that group in October 2026. These links are still suspicions, not proof.

Why it matters

This may be one of the first known cases where an attacker used AI to run a cyberattack on a company. It shows that AI tools can make hacking faster and easier. Customers may face scams, so they should be careful with messages or calls that claim to come from 123 Reg. The company advises them to check by going straight to its official website.

What to watch

  • Whether 123 Reg confirms who was behind the attack.
  • Whether the stolen data appears online or is used in scams.
  • Any action from the UK and EU data protection authorities that were told about the attack.
  • Whether more groups use ARTEX or similar AI tools to attack companies.

Glossary

123 Reg
A UK company that helps people register and manage website names (domain names).
ARTEX
An open-source Chinese AI tool that tests computer systems for weak spots, and can also be used by attackers.
Claude Code
An AI coding tool made by Anthropic that can write and run code.
CrowdStrike
A cybersecurity company that finds and reports hacking groups and attacks.

Same story, different eyes

Ad

Add 150 words. Learn 10 a day.

Dicter word books send only the words you learn to your review notes.

More in this topic

SecurityArs Technica

China’s snooping around Pacific undersea cables raises risks for Big Tech

A new report says subsea cables owned by US companies such as Google and Meta face some of the greatest risks of deep-sea sabotage in the Pacific Ocean, as Chinese research ships spend unusual amounts of time apparently surveying cables. The report, contracted to the London-based China Strategic Risks Institute and published by the US-China Economic and Security Review Commission in September 2026, includes an interactive Trans-Pacific Cable Gray Zone Vulnerability Index that ranks at-risk cables using factors such as depth, shipping traffic, ownership, and whether a cable connects to Taiwan.

SecurityITmedia

"Servers with Delayed Security Measures Are Being Targeted Across the Board": Luck CTO Warns Amid Successive Unauthorized Access

At KDDI SUMMIT 2026 on October 28, Luck CTO Hiroaki Kuramochi said that systems with postponed security measures, such as delayed vulnerability assessments, lack of WAF, or outdated PHP versions, are being targeted across the board. He noted that AI has sharply reduced the cost and time needed for attackers to scan systems and exploit vulnerabilities, and that infostealer malware is stealing employee credentials, making perimeter monitoring alone insufficient. He recommended deploying EDR on servers and penetration testing, and said AI has not created entirely new problems but has exposed long-overlooked weaknesses.

Security전자신문

DevStack Says AI-Era Zero-Day Threats Require Multi-Agent Collaboration

At K-OPENSOURCE AX 2026, DevStack CEO Seung-wook Jang proposed a security system in which multiple specialized AI agents analyze and cross-verify vulnerabilities, with real responses kept under human approval and control. He presented MetaOps, an open-source agent-based security platform, which coordinates tools such as CodeQL, YARA, Nmap, and AFL++ and packages results into an evidence bundle reviewed by a separate agent. The company also said it applies AI to runtime monitoring, where LLMs analyze alerts from Falco, while system changes still require operator approval.

Securityheise online

Wednesday: Spyware-Laced Ads Targeting Starlink Users, Amazon's Globalstar Acquisition

Israeli company Discover-Tech reportedly uses online advertising infrastructure to deliver spyware, and it is said to be the world's second-largest buyer of ads aimed at Starlink users, and the largest in 105 countries. The US FCC has approved Amazon's acquisition of satellite operator Globalstar, valued at $11.5 billion, after rejecting the only objection, filed by Yippy, a company with a stake in Globalstar.