--- title: 123 Reg discloses 'AI cyberattack' on customer data,... description: UK domain registrar 123 Reg disclosed what it calls 'the first known AI-driven cyberattack' against the company, exposing customer contact data. The September... canonical: https://daily.dev/posts/123-reg-discloses-ai-cyberattack-on-customer-data-suspects-china-nexus-vwvowrvt7 twitter:card: summary_large_image twitter:site: @dailydotdev og:type: website og:site_name: daily.dev og:title: 123 Reg discloses 'AI cyberattack' on customer data, suspects China nexus | daily.dev og:description: UK domain registrar 123 Reg disclosed what it calls 'the first known AI-driven cyberattack' against the company, exposing customer contact data. The September... og:url: https://daily.dev/posts/123-reg-discloses-ai-cyberattack-on-customer-data-suspects-china-nexus-vwvowrvt7 og:image: https://api.daily.dev/og/posts/vwVowrvt7.png og:image:alt: 123 Reg discloses 'AI cyberattack' on customer data, suspects China nexus og:image:width: 1200 og:image:height: 630 og:locale: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # 123 Reg discloses 'AI cyberattack' on customer data, suspects China nexus **[The Register](https://daily.dev/sources/theregister)** · 4 min read · 0 upvotes · 0 comments ## Summary UK domain registrar 123 Reg disclosed what it calls 'the first known AI-driven cyberattack' against the company, exposing customer contact data. The September 18 intrusion compromised names, phone numbers, VAT numbers, product information and marketing preferences. 123 Reg says attacker infrastructure was hosted in China and Singapore, and found copies of Anthropic's open-sourced skills and other AI exploitation tools on Chinese servers. The company suspects a Chinese state-sponsored group previously tied to Claude Code abuse against at least 30 organizations could be behind the attack, and that the same group that used the open-source tool ARTEX against South Korean financial institutions may be responsible. 123 Reg says the activity was limited to reading data but copies may have been made, and it worked with Singapore ISPs to disrupt the attacker's servers. ## Full article daily.dev links to this article rather than hosting it. Read it at the original source: ## Questions this post answers ### What is ARTEX and how was it used in the attacks on South Korean banks and 123 Reg? ARTEX is an open-source Chinese-developed agentic penetration-testing tool released in July 2026. CrowdStrike advisory CSA-261162, published October 7, 2026, described a likely Chinese-speaking actor using ARTEX against several South Korean financial organizations starting in late September 2026, the same tool observed in the attack against UK domain registrar 123 Reg during the same period. _Security teams tracking agentic AI attack tools can follow breach disclosures like this on daily.dev._ ### What customer data was exposed in the 123 Reg breach? The exposed data included customer names, phone numbers, countries, language and currency preferences, account creation dates, products on the account, marketing preferences, company VAT numbers, and related customer relationship data, plus product information pulled from an API. 123 Reg said the September 18, 2026 intrusion was limited to reading data, though copies may have been made. _Anyone assessing breach notification scope can track incident details like these on daily.dev._ ### How did attackers reportedly use Claude Code or Anthropic's open-source AI skills in the 123 Reg breach? Investigators found copies of 'anthropic_skills,' skills open-sourced by Anthropic, hosted on Chinese infrastructure alongside other AI exploitation frameworks and scripts. The naming conventions and mirrored skills led 123 Reg to suspect a Chinese state-sponsored group previously known for abusing Claude Code in attacks against at least 30 organizations. _Developers evaluating risks of AI coding agents being weaponized can follow this story on daily.dev._ ## Similar posts on daily.dev - [AI helps Chinese-speaking hackers speed up attacks on exposed servers](https://daily.dev/posts/ai-helps-chinese-speaking-hackers-speed-up-attacks-on-exposed-servers-os1x7amnl) · CSO Online · 1 upvotes · 0 comments - [TAG-217 Targets South Korean Financial Services with ARTEX](https://daily.dev/posts/tag-217-targets-south-korean-financial-services-with-artex-joikgzti8) · Recorded Future Blog · 0 upvotes · 0 comments - [Chinese cybercrime operation that used AI to scam ‘hundreds of thousands of victims’ sued by Google](https://daily.dev/posts/chinese-cybercrime-operation-that-used-ai-to-scam-hundreds-of-thousands-of-victims-sued-by-google-qigyilihp) · TechCrunch · 0 upvotes · 0 comments --- Tags: [#security](https://daily.dev/tags/security), [#claude-code](https://daily.dev/tags/claude-code), [#data-breach](https://daily.dev/tags/data-breach) [View this post on daily.dev](https://daily.dev/posts/123-reg-discloses-ai-cyberattack-on-customer-data-suspects-china-nexus-vwvowrvt7) ```json {"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]} {"@context":"https://schema.org","@type":"TechArticle","headline":"123 Reg discloses 'AI cyberattack' on customer data, suspects China nexus","url":"https://daily.dev/posts/123-reg-discloses-ai-cyberattack-on-customer-data-suspects-china-nexus-vwvowrvt7","mainEntityOfPage":{"@type":"WebPage","@id":"https://daily.dev/posts/123-reg-discloses-ai-cyberattack-on-customer-data-suspects-china-nexus-vwvowrvt7"},"datePublished":"2026-10-28T11:48:47.101Z","dateModified":"2026-10-28T15:03:28.392Z","description":"UK domain registrar 123 Reg disclosed what it calls 'the first known AI-driven cyberattack' against the company, exposing customer contact data. The September...","image":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/3444eb4c791150e7a96af8d759d3a196?_a=AQAEuop","thumbnailUrl":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/3444eb4c791150e7a96af8d759d3a196?_a=AQAEuop","isAccessibleForFree":true,"articleSection":"The Register","inLanguage":"en","publisher":{"@type":"Organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180}},"author":{"@type":"Organization","name":"The Register","logo":"https://media.daily.dev/image/upload/t_logo,f_auto/v1/logos/66aa2113fdad463992ffcbf0e8963fda","url":"https://daily.dev/sources/theregister"},"commentCount":0,"discussionUrl":"https://daily.dev/posts/123-reg-discloses-ai-cyberattack-on-customer-data-suspects-china-nexus-vwvowrvt7","interactionStatistic":[{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":0},{"@type":"InteractionCounter","interactionType":{"@type":"CommentAction"},"userInteractionCount":0}],"keywords":"security,claude-code,data-breach","timeRequired":"PT4M"} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"The Register","item":"https://daily.dev/sources/theregister"},{"@type":"ListItem","position":3,"name":"123 Reg discloses 'AI cyberattack' on customer data, suspects China nexus"}]} {"@context":"https://schema.org","@type":"FAQPage","@id":"https://daily.dev/posts/123-reg-discloses-ai-cyberattack-on-customer-data-suspects-china-nexus-vwvowrvt7#faq","mainEntity":[{"@type":"Question","name":"What is ARTEX and how was it used in the attacks on South Korean banks and 123 Reg?","acceptedAnswer":{"@type":"Answer","text":"ARTEX is an open-source Chinese-developed agentic penetration-testing tool released in July 2026. CrowdStrike advisory CSA-261162, published October 7, 2026, described a likely Chinese-speaking actor using ARTEX against several South Korean financial organizations starting in late September 2026, the same tool observed in the attack against UK domain registrar 123 Reg during the same period. Security teams tracking agentic AI attack tools can follow breach disclosures like this on daily.dev."}},{"@type":"Question","name":"What customer data was exposed in the 123 Reg breach?","acceptedAnswer":{"@type":"Answer","text":"The exposed data included customer names, phone numbers, countries, language and currency preferences, account creation dates, products on the account, marketing preferences, company VAT numbers, and related customer relationship data, plus product information pulled from an API. 123 Reg said the September 18, 2026 intrusion was limited to reading data, though copies may have been made. Anyone assessing breach notification scope can track incident details like these on daily.dev."}},{"@type":"Question","name":"How did attackers reportedly use Claude Code or Anthropic's open-source AI skills in the 123 Reg breach?","acceptedAnswer":{"@type":"Answer","text":"Investigators found copies of 'anthropic_skills,' skills open-sourced by Anthropic, hosted on Chinese infrastructure alongside other AI exploitation frameworks and scripts. The naming conventions and mirrored skills led 123 Reg to suspect a Chinese state-sponsored group previously known for abusing Claude Code in attacks against at least 30 organizations. Developers evaluating risks of AI coding agents being weaponized can follow this story on daily.dev."}}]} ```