123 Reg was breached. Expect a very convincing phone call.

One of the UK’s best-known domain registrars has started emailing customers about a 123 Reg data breach. The company says an attacker got into its systems on 18 September and read customer data, in what it calls “the first known AI-driven cyberattack against our company”. Notification emails began landing last week.

If your business bought its domain name, email or website hosting through 123 Reg, this is worth ten minutes of your morning. Not because your website is about to fall over, but because of what the stolen details make possible.

What was taken

According to the customer email and a company spokesperson quoted by The Register, the exposed data includes:

• Names, phone numbers and contact details
• Company VAT numbers
• Which products are on each account, and when the account was opened
• Country, language, currency and marketing preferences

123 Reg says the attacker’s activity “was limited to reading” the data, but admits “it’s possible they created copies”, which is why it’s warning customers. Passwords and payment details aren’t on the list it has published. It has reported the attack to law enforcement and to the UK and EU data protection regulators, including the ICO.

Why that list matters more than it looks

None of this lets anyone log straight into your account. What it does is give a scammer everything they need to sound exactly like 123 Reg. They know your name, your direct number, your VAT number, how long you’ve been a customer and exactly which domains and hosting you pay for.

So the call or email you might get doesn’t say “Dear customer”. It says: “Hi, it’s 123 Reg. The hosting package you’ve had with us since 2019 has a renewal problem, and your domain will go offline tonight unless we fix the payment.” That’s a very convincing reason to read out a card number or a verification code.

The prize for the criminal isn’t usually the card payment. It’s your domain. Whoever controls your domain controls where your email and website point, and that’s a short step from reading your mail, resetting your other passwords and sending invoices that genuinely come from your address.

The scams to watch for

• Fake renewal or “expiry” notices with a link to pay, often urgent and often very well branded.
• Phone calls from “123 Reg support” asking you to confirm a code they’ve just texted you. That code is the key to your account.
• “Security check” emails that ask you to log in through a link to “protect your account after the breach”.
• Invoices or VAT queries that quote your real VAT number to look official.

123 Reg has been clear that it will never ask for your password, payment details or verification codes by email, text or phone. Anyone who does isn’t them.

What to do this week

1. Turn on two-step verification on your 123 Reg account, and on whichever email address it’s registered to. My guide to turning on MFA covers the email side.
2. Lock your domains down. If your account offers a domain or transfer lock, switch it on, so nobody can quietly move your domain to another registrar.
3. Check who has access. Look at the users and contact email on the account. Remove anyone who’s left, and make sure the contact address is one you still read.
4. Brief whoever pays the bills. Tell them that any call, email or text about your domain gets checked by logging in to 123 Reg directly, never through a link or a number in the message.
5. Know your renewal dates. If you know your domain renews in March, an “urgent” renewal call in November is an instant red flag.
6. Check your email security settings. My free email security check shows whether your domain’s SPF, DMARC and DKIM records make it harder for criminals to send email that looks like it’s from you.

The AI part

123 Reg says it found AI attack tooling on the attacker’s servers and links the intrusion to an open-source “agentic” hacking tool used against banks in South Korea around the same time. It also suspects a China-linked group. That attribution is the company’s own assessment and hasn’t been independently confirmed, so I’d treat it with some caution.

What I would take from it is the direction of travel. Tools that let attackers probe systems quickly and around the clock are now freely available. The defences that hold up against that are the boring basics done consistently: patched systems, multi-factor authentication, sensible admin rights and staff who know a scam when they hear one. That’s exactly the baseline Cyber Essentials sets, and it works whether the attacker is a person or a script.

If you’ve already been caught out

If someone has already had a code, a password or a payment out of you, log in to 123 Reg directly, change your password, check your domain settings haven’t changed and call your bank if you paid anything. If your email or domain is already behaving oddly, treat it as a cyber incident and get help quickly. The first few hours make a real difference.

Sources

• The Register: 123 Reg discloses ‘AI cyberattack’ on customer data, suspects China nexus (28 October 2026)
• Resultsense: 123 Reg discloses AI-driven breach of customer data (29 October 2026)