123 Reg Discloses AI-Driven Cyberattack Linked to Chinese Nexus
Domain registrar confirms customer data breach involving sophisticated AI exploitation frameworks and infrastructure.
1Breach of Customer Data
UK domain registrar 123 Reg confirmed an AI-driven cyberattack occurred on September 18. Compromised information includes customer names, phone numbers, VAT numbers, and API-related product data. The company notified affected users this week, warning that contact details, language preferences, and account creation dates were exposed during the unauthorized system intrusion.
2Attribution to Chinese Nexus
Investigations identified core attacker infrastructure hosted in China and Singapore. 123 Reg suspects a Chinese state-sponsored group is responsible, citing specific naming conventions and the presence of AI exploitation scripts. The company noted that the attacker's infrastructure mirrors patterns previously linked to operations targeting at least thirty other global organizations.
3Use of AI Exploitation Tools
The attackers utilized open-source AI exploitation frameworks, including copies of skills originally released by Anthropic. Evidence suggests the use of ARTEX, an agentic penetration-testing tool developed in China and released in July 2026. These tools were deployed to automate the breach, marking a shift toward AI-augmented operations in state-sponsored cyber campaigns.
4Parallel Financial Sector Attacks
The incident aligns with a series of attacks against South Korean financial institutions identified in late September 2026. CrowdStrike’s report CSA-261162 details a Chinese-speaking actor using the ARTEX tool during the same timeframe. This suggests 123 Reg was part of a broader, coordinated campaign targeting multiple sectors using similar agentic exploitation techniques.
5Operational Response and Mitigation
123 Reg engaged external cybersecurity support and reported the breach to law enforcement, the FTC, and UK/EU data protection authorities. The company collaborated with Singapore-based ISPs to dismantle the attacker's server infrastructure. These combined efforts with industry partners successfully disrupted the ongoing attack sequence, preventing further unauthorized access to the registrar's systems.
6Scope of Data Exposure
While the registrar stated the attacker's activity was primarily limited to reading data, they acknowledged the possibility that copies of the information were created. This uncertainty prompted the formal notification to customers. The company is currently treating the incident as a significant data compromise, urging all users to remain vigilant against potential misuse.
7Customer Security Recommendations
The company advised customers to exercise extreme caution regarding incoming communications. Users are encouraged to log in directly through the official website rather than clicking links in emails. 123 Reg emphasized that they will never request passwords or payment details via phone or text, recommending two-step verification as a primary defense.
8Implications for AI Security
This breach highlights the growing threat of AI-augmented cyberattacks, where state-sponsored actors leverage open-source agentic tools to scale operations. As attackers refine their use of frameworks like ARTEX, organizations must prioritize robust API security and proactive threat hunting. The incident serves as a critical reminder of the evolving landscape of automated digital threats.