123 Reg, a British domain registrar that The Register describes as owned by GoDaddy, has told customers that what it calls an "AI-driven cyberattack" exposed their data and that it suspects a Chinese state-sponsored group, The Register reported Wednesday. The notice puts artificial intelligence attack tooling into a mainstream provider's breach disclosure, and the exposed details are the kind criminals use to impersonate a registrar to domain owners.
What Happened
According to the notice as described by The Register, the intrusion took place Sept. 18, and the company calls it "the first known AI-driven cyberattack against our company." Customers were notified this week.
Exposed information included contact details and related customer relationship data, company value-added tax (VAT) numbers and product information pulled through an API, the interface that lets software systems exchange data. A spokesperson told The Register the fields included names, phone numbers, countries, language and currency preferences, account creation dates and products held. The company has not said how many customers were affected.
The notice says the attacker's activity "was limited to reading" customer data, but the spokesperson said copies may have been made, which prompted the notifications.
123 Reg said it reported the attack to law enforcement, hired outside responders, notified the U.S. Federal Trade Commission (FTC) and data protection authorities in the UK and European Union, and worked with internet service providers in Singapore to take down attacker servers there.
The Suspected China Link
The attribution is the company's own suspicion, and no government has confirmed it. 123 Reg said IP addresses it assessed as the attackers' core infrastructure were hosted in China and Singapore, which it said points to "a strong Chinese nexus." It also said it found AI attack "skills," packaged instructions that extend what an AI agent can do, on Chinese-hosted servers, along with other AI exploitation tools.
The company suspects a Chinese state-sponsored group but has not named it, and The Register's report does not explain how AI was used inside 123 Reg's systems.
Why It Matters
For boards, the case shows AI agent tooling surfacing in a breach notice, with attribution resting on a company's own forensic reading rather than a government finding. The FTC notification and GoDaddy ownership give it a U.S. angle. The Primary Wire reported Oct. 19, citing Reuters, on one hacker who used AI agents to breach more than 100 company websites.
123 Reg told customers to distrust unexpected messages claiming to come from it, log in directly through its website and turn on two-step verification.
What to Watch
Open questions are how many customers were affected, how the attacker got in and whether any government agency backs the company's suspicion of a Chinese state link. Watch also for responses from the FTC and UK and EU regulators, and for phishing that uses the exposed details.
