If your business website or email address uses a domain name bought from 123 Reg, you may have had an email from them this week.
The UK domain registrar, owned by GoDaddy, says an attacker read customer data in what it calls "the first known AI-driven cyberattack against our company".
Passwords and card details aren't on its list of exposed data. But what was exposed is exactly what a scammer needs to write a convincing "your domain is about to expire" email.
What happened
According to The Register, the intrusion took place on 18 September, and customers started receiving notification emails this week. 123 Reg says the attacker's activity "was limited to reading" customer data, but a spokesperson said it's "possible they created copies of the information", which is why customers are being told.
The exposed details include names, phone numbers, countries, language and currency preferences, account creation dates, the products on each account, marketing preferences and company VAT numbers. 123 Reg hasn't said how many customers are affected.
The company has reported the attack to law enforcement, brought in outside security support and notified data protection authorities in the UK and EU, as well as the US Federal Trade Commission. It also worked with internet providers in Singapore to shut down the attacker's servers there.
Why "AI-driven"?
123 Reg says its investigation found AI attack "skills", along with several AI exploitation frameworks and scripts, hosted on the attacker's infrastructure. It believes servers in China and Singapore were at the core of the attack, which it says points to a "strong Chinese nexus", and it suspects a group linked to recent AI-assisted attacks on South Korean financial firms. That attribution hasn't been confirmed.
For a small business, who did it matters less than how. AI is making this kind of work cheaper and faster for attackers, as we covered in AI hackers now cost $25 a target. Suppliers that hold data on thousands of small firms are an obvious place to start.
Why your domain matters
Your domain name is more than your web address. Your email runs on it, and many cloud services use it to prove you are who you say you are.
The NCSC puts it plainly: "Attackers may try to gain control of your domain name to hijack your websites" and other services that rely on it, including email. "So it is critical that you keep your domain secure."
Whoever controls your registrar account can point your website somewhere else or redirect your email. GOV.UK's domain guidance lists what can follow a hijack: intercepted email, impersonation, redirects to inappropriate sites and phishing for personal details.
What this means for UK small businesses
The biggest short-term risk is phishing. A scammer who knows your name, your phone number, when you opened your account and which products you pay for can write an email, or make a call, that sounds exactly like your registrar. "Your renewal payment failed. Log in now or your website will go offline." That's the kind of message to expect.
Phishing is already the attack small firms meet most. The government's Cyber Security Breaches Survey 2025/26 found 38% of businesses experienced phishing in the past year, and 42% of micro and 46% of small businesses identified a breach or attack. Only 47% of businesses use any form of two-factor authentication.
Plenty of small firms also don't know who really controls their domain. It was often registered years ago by a founder, a former employee or a web designer, sometimes on a personal email address. That's the gap the NCSC warns about.
What to do this week
Turn on two-step verification at your registrar. 123 Reg is urging its customers to do this. Do it whichever registrar you use, and protect the email account that receives its password resets in the same way.
Never log in from a link. 123 Reg says it will never ask for passwords, payment details or verification codes by email, text or phone. If a renewal or security message arrives, go to the registrar's website yourself.
Find out who holds the keys. Check which email address owns your registrar account. If it's a personal address, or belongs to someone who has left, move it to an account your business controls, as the NCSC advises.
Check renewal dates and contact details. Make sure renewal reminders go to an inbox someone actually reads, and that the payment card on file is up to date. A lapsed domain takes your email down with it.
Ask about locking your domain. Many registrars offer a lock that blocks transfers or changes without extra checks. Ask yours what it offers and switch it on.
Sophia Says
I'm glad 123 Reg told its customers what was taken and gave clear advice. That's how it should be done. But it's a reminder that your domain sits with a supplier you probably think about once a year, at renewal time. Attackers think about it far more often, because whoever controls your domain controls your website and your email.
HackRisk helps you see the whole picture. We map what's publicly visible about your domain and email set-up, watch for your business logins turning up in breach dumps and criminal markets, and train your team to spot a fake "renewal failed" email before they click. You can't protect what you can't see, so start by knowing exactly who holds the keys to your domain.
— Sophia, HackRisk AI Security Analyst
Where HackRisk fits
Your domain and email set-up: Recon Scan shows what attackers can see about your domain and online footprint, and Vulnerability Scan finds weak spots on the website your domain points to.
Leaked logins: Dark Web Scan watches for your business email addresses and passwords appearing in breach dumps and criminal markets.
Your registrar and hosting provider: Supply Chain Risk helps you understand the security of the suppliers your website and email depend on.
Fake renewal emails: Phishing Simulations and Security Awareness Training teach staff to spot registrar and renewal scams before they hand over a login.
Get your free HackRisk report
Find out what attackers can already see about your business, including your domain, leaked logins and exposed systems, in a plain-English report. Get your free HackRisk report.
