123 Reg review: Security After September 2026 AI-Driven Attack

123 Reg, a long-established UK domain registrar owned by GoDaddy, reported its first known AI-driven cyberattack on 18 September 2026. The incident exposed names, phone numbers, countries, language preferences, account creation dates, products held, marketing preferences, and VAT numbers for some business customers. No passwords, payment information, or account access credentials were obtained.

123 Reg security review: Details of the September 2026 breach

The company attributed the intrusion to infrastructure located in China and Singapore. Investigators found AI tools, including mirrored open-source Anthropic capabilities, along with exploitation scripts on servers tied to the attackers. 123 Reg suspects a China-nexus actor, possibly linked to the open-source ARTEX tool previously observed in South Korean financial intrusions, though this remains the company’s assessment without independent confirmation.

Activity was limited to reading data through an API. The registrar has not disclosed the number of affected accounts, and the investigation continues as of late October 2026. No confirmed instances of data misuse have been reported so far. Customers began receiving notification emails the week of 28 October 2026.

123 Reg incident: Response measures and user actions

123 Reg notified UK and EU data protection authorities, the US FTC, and law enforcement. It engaged external cybersecurity experts and worked with Singapore internet providers to disable attacker servers. The company states it will never request passwords, verification codes, or payment details by email, text, or phone.

Users are advised to enable two-step verification on their accounts and to log in only through the official website rather than links in messages. They should also monitor for suspicious contacts and treat any unsolicited requests with caution. The following steps summarize the registrar’s guidance:

• Activate two-step verification immediately in account settings.
• Log in directly at the 123 Reg site without using email or text links.
• Review recent account activity for any unusual changes.
• Monitor email and phone for potential phishing attempts using exposed contact data.

123 Reg maintains ICANN accreditation with IANA ID 1515 and manages millions of domains. It holds a Trustpilot rating of approximately 3.8 out of 5 from over 21,000 reviews, with recurring notes on support response times and billing processes. As of 30 October 2026, regulators have received the breach reports, but further updates or advisories may follow as forensics continue.