EN PT-BR
← Voltar ao feed
medium technology telecommunications

123 Reg discloses AI-driven intrusion exposing customer data, suspects China-nexus actor linked to ARTEX

1 fonte(s) · 1 atualização(ões) · publicado 28/10/2026 08:45 · coletado há 4 dias

UK domain registrar 123 Reg (owned by GoDaddy) disclosed that it suffered an "AI-driven cyberattack" on September 18, exposing customer contact data, company VAT numbers and product information obtained via an API. The company assesses a China nexus based on attacker infrastructure hosted in China and Singapore and on AI attack "skills" found on Chinese servers, including a mirror of Anthropic's open-sourced skills. It suspects a Chinese state-sponsored group known for abusing Claude Code against at least 30 organizations, and possibly the same actor that used the open-source Chinese agentic pentesting tool ARTEX against South Korean financial institutions (CrowdStrike CSA-261162, published October 7, 2026). These attributions are the company's own assessment and are not independently confirmed in the article. Customers are being notified this week.

Detalhes técnicos

  • Exposed data: names, phone numbers, countries, language and currency preferences, account creation dates, products on the account, marketing preferences, VAT numbers and API-sourced product information.
  • The attacker's activity was described as limited to reading data, but copying cannot be ruled out.
  • The article cites artefacts consistent with AI-augmented operations: a mirror of "anthropic_skills", account naming conventions on Chinese servers, and several AI exploitation frameworks and scripts.
  • ARTEX is a Chinese-developed open-source agentic penetration-testing tool released in July 2026, which 123 Reg says was also observed in the attack against it.
  • The initial access vector is not disclosed.

Remediação

  • 123 Reg reported the incident to law enforcement, the FTC and UK/EU data protection authorities, engaged outside cybersecurity support, and worked with Singapore-based ISPs to take down attacker servers.
  • Customers should treat unsolicited messages or calls claiming to be from 123 Reg with caution and log in directly via the website.
  • 123 Reg states it never requests passwords, payment details or verification codes by email, text or phone.
  • Enable two-step verification (2SV) on 123 Reg accounts.

Linha do tempo

  1. theregister.com ↗ · pub. 28/10/2026 08:45 · coletado 28/10 10:00 primeiro registro

    123 Reg discloses AI-driven intrusion exposing customer data, suspects China-nexus actor linked to ARTEX

    ler a análise desta fonte

    UK domain registrar 123 Reg (owned by GoDaddy) disclosed that it suffered an "AI-driven cyberattack" on September 18, exposing customer contact data, company VAT numbers and product information obtained via an API. The company assesses a China nexus based on attacker infrastructure hosted in China and Singapore and on AI attack "skills" found on Chinese servers, including a mirror of Anthropic's open-sourced skills. It suspects a Chinese state-sponsored group known for abusing Claude Code against at least 30 organizations, and possibly the same actor that used the open-source Chinese agentic pentesting tool ARTEX against South Korean financial institutions (CrowdStrike CSA-261162, published October 7, 2026). These attributions are the company's own assessment and are not independently confirmed in the article. Customers are being notified this week.

    Technical Details

    • Exposed data: names, phone numbers, countries, language and currency preferences, account creation dates, products on the account, marketing preferences, VAT numbers and API-sourced product information.
    • The attacker's activity was described as limited to reading data, but copying cannot be ruled out.
    • The article cites artefacts consistent with AI-augmented operations: a mirror of "anthropic_skills", account naming conventions on Chinese servers, and several AI exploitation frameworks and scripts.
    • ARTEX is a Chinese-developed open-source agentic penetration-testing tool released in July 2026, which 123 Reg says was also observed in the attack against it.
    • The initial access vector is not disclosed.

    Remediation

    • 123 Reg reported the incident to law enforcement, the FTC and UK/EU data protection authorities, engaged outside cybersecurity support, and worked with Singapore-based ISPs to take down attacker servers.
    • Customers should treat unsolicited messages or calls claiming to be from 123 Reg with caution and log in directly via the website.
    • 123 Reg states it never requests passwords, payment details or verification codes by email, text or phone.
    • Enable two-step verification (2SV) on 123 Reg accounts.