123 Reg discloses an AI-driven cyberattack on customer data

[Silas75]

A major UK domain registrar has reported what it calls its first AI driven cyberattack. The Register reports that 123 Reg, owned by GoDaddy, says an attack on 18 September exposed customer data

The data included names, phone numbers, countries, language and currency preferences, account creation dates, products held, marketing preferences and company VAT numbers. It was taken through an API, and the company says the attacker's activity was limited to reading data, although copies may have been made

123 Reg says it traced core attacker IP addresses to China and Singapore, which it describes as a strong Chinese nexus. On that infrastructure it found AI attack skills, including copies of skills Anthropic had open sourced

The company believes a group reported to have abused Claude Code against at least 30 organisations, which may also be linked to recent attacks on South Korean banks using an agentic penetration testing tool. 123 Reg has told law enforcement and UK and EU data regulators, and had the attacker's servers in Singapore taken down. The attribution is the company's own suspicion rather than a formal finding

AI tools that help defenders find weaknesses can clearly help attackers too, and this is one of the first public cases of a UK company describing an attack this way. Customers should watch out for phishing that uses the leaked details. The full picture of how the attack worked will take time to emerge

How worried should we be about AI driven cyberattacks? And should AI companies do more to stop their tools being misused?

123 Reg discloseswww.theregister.com