Skip to content
COR Intelligence
Back to The Patch Wave
The Patch WaveThis weekFound by: not stated

123 Reg customers: contact and account details exposed, watch for fake 123 Reg messages

COR Solutions29 October 2026
4 min read917 words

123 Reg is emailing customers about a cyberattack on 18/09/2026 that exposed contact and account details. Turn on two-step verification and treat any 123 Reg call or email with care.

LinkedInXEmail
A cordless phone in its cradle and a softly glowing smartphone beside a closed laptop, blank envelopes and a cup of tea on a sunlit wooden desk.

What happened

UK domain and hosting company 123 Reg has started emailing customers to say an attack on 18/09/2026 exposed customer data. According to The Register, which quotes the email and a 123 Reg spokesperson, that means names, phone numbers, country, language and currency settings, account start dates, which products are on the account, marketing preferences and company VAT numbers. 123 Reg calls it "the first known AI-driven cyberattack against our company" and suspects a China-linked group. It says it has reported the attack to law enforcement and told the US Federal Trade Commission and the UK and EU data protection regulators.

Does this affect you

If your business has a domain, hosting or email with 123 Reg, look for 123 Reg's email about the attack. 123 Reg hasn't said how many customers are affected. Neither its email nor its spokesperson, as quoted by The Register, lists passwords or payment card details among the data taken.

Even without that email, expect more fake "123 Reg" messages for a while. The NCSC warns that criminals "may even send messages pretending to be from an organisation that has suffered a recent data breach".

What to do this week

  1. Turn on two-step verification (a code on your phone as well as your password) in your 123 Reg account. 123 Reg recommends this in its email. In your account, open Login & Security and, under Enhanced Security, switch on 2-Step Verification. You need at least one verification method set up first (123 Reg help).
  2. Tell whoever handles your domain or invoices that fake "123 Reg" emails, texts or calls are now more likely, and that they will know your name, products and VAT number. 123 Reg says it will never ask for your password, payment details or codes by email, text or phone. Phone numbers were in the data, so a call is as likely as an email. The ICO warns that criminals use breach data to pose as organisations "such as your bank or HMRC", so give an unexpected VAT or HMRC message the same care.
  3. If a message worries you, don't click anything in it. Go to the 123 Reg website yourself and log in. Not every 123 Reg message is fake: in October it sent genuine emails and texts about replacing SSL certificates, and its status page says so. Logging in yourself is the safe check either way.
  4. Check your domains are locked. 123 Reg says a lock protects a domain "from any unauthorised transfers". In your domain list, choose Lock, then Turn Lock On (123 Reg help).
  5. Report anything suspicious. Forward a suspicious email to report@phishing.gov.uk and a suspicious text to 7726, the NCSC's free reporting routes. If someone has been tricked into paying, tell your bank and report it to Report Fraud (in Scotland, call the police on 101). A business under cyber attack can call Report Fraud on 0300 123 2040.

Is it being attacked? This is an attack that has already happened. No misuse of the data had been reported as of 28/10/2026.

For developers

  • No CVE. Intrusion dated 18/09/2026 by 123 Reg; customers "began receiving their notification emails this week" (The Register, 28/10/2026).
  • Data listed in the customer email (as quoted): contact information, "related customer relationship data," company VAT numbers, and "product information from an application programming interface (API)". The spokesperson's fuller list: names, phone numbers, countries, language and currency preferences, account creation dates, products on the account, marketing preferences.
  • 123 Reg's email says the activity "was limited to reading" customer data; the spokesperson added "it's possible they created copies of the information."
  • Attribution is 123 Reg's own assessment, not confirmed by any government agency: attacker infrastructure "hosted in China and Singapore", Ai attack "skills" hosted on Chinese infrastructure "including copies of skills open sourced by Anthropic", and a link drawn to CrowdStrike's CSA-261162 report of 07/10/2026 on an actor using the open-source agentic tool ARTEX against South Korean financial firms. CrowdStrike's public post of 07/10/2026 describes that campaign (late September to early October 2026) and does not mention 123 Reg; the reference CSA-261162 does not appear on it.
  • Reported to law enforcement, the US Federal Trade Commission and the UK and EU data protection authorities (The Register).
  • 123 Reg is owned by GoDaddy (The Register).

Sources

Read next

More from The Patch Wave