If your business holds domains with 123 Reg, there is probably an email from the company sitting in somebody’s inbox. The 123 Reg data breach happened on 18 September 2026, and customers were told about it in the week of 28 October. Six weeks separate those two dates.
Most of the coverage has led on the phrase the registrar used to describe the attack, which was “the first known AI-driven cyberattack against our company”. That is the interesting part of the story. It is not the useful part.
Nothing 123 Reg has described includes passwords, payment details or the authorisation codes needed to move a domain. That makes this a phishing problem rather than an account takeover problem, and the two call for different responses.
What 123 Reg Says Was Taken
123 Reg is a UK domain registrar owned by GoDaddy. In its notification email it described the affected data in four categories: “contact information”, “related customer relationship data”, company VAT numbers, and “product information from an application programming interface (API)”.
A company spokesperson put detail on those categories. The fields involved were names, phone numbers, countries, language and currency settings, the date each account was opened, the products held on each account, and marketing preferences.
On what the intruder did with the data, the notification says the activity “was limited to reading” it. The spokesperson was more direct about the limits of that assurance: “it’s possible they created copies of the information”. That possibility is the reason the emails went out at all.
123 Reg reported the incident to law enforcement, brought in outside cyber security support, and notified the data protection authorities in the UK and the EU along with the US Federal Trade Commission. It has not published a customer count, so the scale of the 123 Reg data breach is still unknown. The detail of what the company said was first reported by The Register on 28 October.
What Is Not on the List, and Why It Matters
Four things are absent from everything 123 Reg has said: account passwords, payment card details, DNS zone records, and the EPP authorisation codes that are needed to transfer a domain to another registrar.
Be careful with that observation, because absence from a list is not the same as a denial. 123 Reg has not published a statement saying those items were untouched. What it has published is a list of what was affected, and they are not on it.
If that list is complete, the consequences are narrower than the headline suggests. Nobody signed into your control panel. Your nameservers were not rewritten, so your website and your email carried on resolving to the places you pointed them. No domain was transferred away, because a transfer needs an authorisation code and an unlocked domain.
What the attacker has instead is a list of real businesses, a named contact at each one, a phone number that reaches them, the products they pay for, the date they became a customer, and in many cases a VAT number. For anyone writing a convincing fake renewal invoice, that is a better starting position than a stolen password. It is the part of the 123 Reg data breach that will cost people money, and it will not arrive this week. It will arrive in a few months, when nobody is watching for it.
Who in Your Business Approves a Domain Renewal?
That is the person this data was taken for. Impersonation protection and phishing simulation are how it gets handled before a fake invoice is paid, not after. Book an initial security consultation with a Transputec security architect.
Book a consultationThe ARTEX Attribution Is Thinner Than the Headlines
This is where the reporting and the underlying research diverge, and they are worth separating.
ARTEX is an agentic penetration testing tool, developed in China and published as open source in July 2026. CrowdStrike wrote it up on 7 October after a campaign against South Korean financial organisations that ran from late September into October. 123 Reg points at the overlap in timing and says ARTEX was used against it too.
Read CrowdStrike’s assessment closely, though, and it claims less than the headlines do. CrowdStrike does not attribute the activity to any named group. It assesses, with moderate confidence, that the operator is “likely a Chinese speaker and financially motivated”. It does not describe a state-sponsored actor at all.
123 Reg goes further than that. It cites IP addresses “that we assessed to be the core attacker infrastructure, which were hosted in China and Singapore, indicating a strong Chinese nexus”, and says it suspects a Chinese state-sponsored group. That is the registrar’s own assessment rather than an independent finding, and it is a larger claim than the research it leans on supports.
One more detail from CrowdStrike’s write-up cuts against the framing in several headlines. The ARTEX instance it examined ran on DeepSeek v4.1-flash as its primary model, with GLM-5.3 and Grok 4.6 appearing elsewhere in the same operation. 123 Reg separately reported finding “copies of skills open sourced by Anthropic and several other AI exploitation frameworks and scripts” on the infrastructure it traced. The accurate summary is that this was commodity tooling pointed at whichever model was cheapest to reach, which is a worse problem than one vendor being misused, because commodity tooling is free to copy.
ARTEX’s developer took the project closed source on 8 October. That does nothing for anyone who already has a copy. None of this changes what you should do about the 123 Reg data breach, but it should change how much weight you give the word “AI” in it. The intrusion was a read of customer records. The automation changed the speed, not the nature.
Why Registrar Data Is Worth More Than It Looks
A registrar knows a handful of things about a business that almost nobody else does, and they happen to be the things that make a fraudulent message believable.
Three attacks get easier with this data.
Fake renewal notices. A domain renewal is a known, recurring, low-value payment that usually goes through without scrutiny. An attacker who knows which products you hold and roughly when you bought them can time a renewal demand to look routine, and the VAT number makes the invoice read like it came out of a system rather than off a keyboard.
Invoice redirection. In a smaller business the registrar contact is often the same person who handles supplier payments. A caller who can name your domains, your products and your account age sounds like your registrar, and “we have changed our bank details” is a short conversation from there. This is the same mechanism behind spear phishing, with the research step already done.
Account recovery and hijack attempts. No credentials were reported taken, so a direct hijack is not on the table. Social engineering towards one is. Your name, your phone number and your account history are most of what a support agent uses to confirm identity, and all of what a convincing credential harvesting page needs to collect the password the attacker does not have.
Timing makes this worse. Data from the 123 Reg data breach left the building six weeks before anyone was warned about it. If it is being traded, the people buying have had a head start on the people defending.
How to Tell a Real 123 Reg Message From a Fake One
123 Reg gave customers one genuinely useful rule in its own notification, and it is worth forwarding to anyone who handles your invoices: “We will never contact you to request your password, payment details, or verification codes by email, text, or phone.”
Its second instruction is the more practical one. “If you receive a message or call and aren’t sure it’s from 123 Reg, go directly to our website and log in.” Never act on the link in the message. Open a new tab and type the address.
Beyond that, the signals that matter are mundane.
- A renewal that is earlier than you expect, or for a domain you do not recognise, or for a product you do not hold
- Any request to change payment details, however it arrives
- Pressure on timing, usually a warning that the domain is about to lapse
- A sender domain that is close to the real one rather than the real one
- A phone call that arrives first, with an email afterwards to confirm it
Suspicious emails go to the NCSC’s Suspicious Email Reporting Service at [email protected], and text messages by forwarding to 7726. Neither gets you a reply, but both feed takedown. The NCSC’s guidance on defending an organisation against phishing is the better thing to circulate internally than anything written in a hurry, and its page for individuals is the one to send to people who do not work in IT.
One structural point that will outlive the 123 Reg data breach. The contact named on a registrar account should not be an individual’s personal mailbox. A role address that several people can see makes an unexpected message easier to question, and much harder to act on quietly.
Your Checklist This Week
None of this is difficult. The reason it does not get done is that it sits across domains, DNS and email, which in most organisations means three different people, or none.
| Check | Where | Why now |
|---|---|---|
| Turn on two-step verification | 123 Reg account settings | 123 Reg recommends it and does not enforce it. It is the control that makes a harvested password worthless. |
| Review the account contact | 123 Reg account settings | Should be a role mailbox, not a person. Check it is someone who still works there. |
| Check who can sign in | Your own records | Leftover agency and contractor access to a registrar panel is the most common route to a lost domain. |
| Enable the transfer lock | Per domain | Stops a transfer completing even if an authorisation code is obtained. |
| Export your DNS zone | Now, before anything changes | You cannot tell that a record changed if you never wrote down what it was. |
| Check MX records | DNS zone | A changed MX record redirects mail silently. Compare against what you expect to see. |
| Check SPF, DKIM and DMARC | DNS zone | A DMARC policy of p=none reports and blocks nothing. Impersonation of your own domain is the second wave. |
| Warn whoever pays invoices | Finance | This attack lands on the person who approves a small renewal, not on IT. |
Two of those deserve more than a line. The transfer lock is free at every registrar worth using, and there is almost no reason to leave it off in the years between transfers. And exporting your DNS zone is the cheapest piece of incident preparation available to a small business: it turns “has something changed?” from an argument into a diff.
If DMARC is the line on that list you are least sure about, it is also the one with the longest tail, because getting to an enforcing policy takes weeks of watching reports rather than an afternoon. On the account side, the NCSC’s guidance on multi-factor authentication for corporate online services covers why second factors on a supplier account are not optional in practice, whatever the supplier’s own default says. Microsoft’s own retirement of SMS and voice MFA is a reminder that where a second factor is text-based, it is the weakest of the options rather than the end of the job.
Everything above is worth doing whether or not you were in the 123 Reg data breach. That is rather the point. The breach is the prompt, not the reason.
The NCSC Tool Your Checklist Probably Still Names
Nearly every “go and check your DMARC” instruction written in the last eight years points at NCSC Mail Check. It is worth knowing that it has gone.
The NCSC retired Mail Check and Web Check on 31 March 2026, having offered them since 2017. Its own wording was that “by 31 March 2026, organisations should have alternatives to Mail Check and Web Check in place”. Users stopped receiving findings from that date.
What the NCSC points to instead:
- Check your cyber security, a free self-service tool that includes email anti-spoofing and email privacy checks. This is the closest direct replacement for what Mail Check did.
- A commercial external attack surface management product. The NCSC strongly recommends implementing one and has published an EASM buyer’s guide for choosing between them.
- Early Warning and DNS Check, which both continue, with findings delivered through MyNCSC.
This matters this particular week. A lot of the advice circulating about the breach is being assembled quickly out of older posts, and an instruction to go and run Mail Check will send somebody to a service that stopped reporting seven months ago. If your internal runbook names it, that is a two-minute correction worth making while you are in there anyway.
Should You Move Registrar?
Probably not, and certainly not because of this.
The case against moving is that what failed here is not something a different registrar demonstrably does better. Registrars hold the same categories of data because registration requires it. A new one would hold the same fields about you, and you would know considerably less about its security than you now know about this one. Switching in a hurry converts a measured exposure into an unmeasured one, and bills you for the privilege.
The case for moving has nothing to do with the 123 Reg data breach. It is about what a registrar lets you do.
- Does it enforce multi-factor authentication, or merely offer it?
- Does it support registry-level lock for your important domains, not just a registrar lock?
- Can you give individual people scoped access, instead of everyone sharing one login?
- Does it notify you when nameservers or contact details change?
- How quickly does it actually answer the phone when a domain is in trouble?
If 123 Reg fails those questions for the domains your business genuinely depends on, it failed them in August and it will fail them in December. Move the handful that matter, on a schedule, for those reasons. Moving everything in a panic during the same week you are also watching for phishing is how mistakes happen, and a botched transfer takes a website down far more reliably than any of this has.
One ordering point. If you are going to move, do it after the transfer lock and the second factor, not instead of them. An account you are planning to leave is still holding live domains today.
Where the 123 Reg Data Breach Leaves Your Email Security
The exposure here is contact data, and contact data gets turned into money through messages. That puts the consequences of the 123 Reg data breach in email rather than in DNS.
Two controls do most of the work. The first is impersonation protection that inspects display names and lookalike domains rather than only attachments and links, because a fake renewal notice carries neither. The second is making sure the people who approve payments have met the attack before it arrives for real, which is what phishing simulation is for and what an awareness slide is not.
We run both for UK organisations as a Mimecast partner, covering anti-phishing and impersonation, continuity and archiving, and human risk reduction. If registrar data is the opening move in a campaign against your finance team, those are the layers it has to get through. Talk to our team about the security work behind it.
If a message has already been acted on, that is a different and faster conversation. Our cyber incident response services run to NIST and ISO/IEC 27035 with analysts on a hotline, which is a number worth having before you need it rather than after. And if the broader question is how exposed your cyber security is to this class of supplier problem, external penetration testing is the part that looks at your estate the way the attacker does.
Frequently Asked Questions
Was my 123 Reg password stolen?
No password appears anywhere in what 123 Reg has described. The fields it listed are contact and account details. The company has not published an explicit statement that passwords were untouched, which is why turning on two-step verification is still the right move: it removes the value of a password whether or not one was taken.
What data was exposed in the 123 Reg breach?
Names, phone numbers, countries, language and currency settings, the date each account was opened, the products held on each account, and marketing preferences, plus company VAT numbers and product information drawn from an API. 123 Reg says the activity was limited to reading the data, while acknowledging that copies may have been made. No customer count has been published.
Could someone steal my domain using this data?
Not directly. Transferring a domain away needs the EPP authorisation code and an unlocked domain, and neither was reported taken. The realistic route is phishing you for your login details. That is why a second factor on the account and a transfer lock on each domain matter more than anything else on the checklist.
Do I need to report this to the ICO?
Almost certainly not for this. 123 Reg is the controller for its own customer records and has notified the UK and EU data protection authorities itself. A reporting duty of your own would only arise if personal data you control were affected, which is not what happened here. If you later suffer a fraud that uses this data, that is a separate incident and may be reportable on its own terms.
Why did it take six weeks to tell customers?
123 Reg has not explained the gap. The intrusion was on 18 September 2026 and the notifications went out in the week of 28 October. UK GDPR requires a controller to notify the ICO without undue delay and within 72 hours of becoming aware of a reportable breach, but that clock starts at awareness rather than at intrusion, and the company has not said when it became aware.
This article was drafted with AI assistance and reviewed by the Transputec team. Featured image: AI-generated.
