1950s pulp illustration of a brass robot registrar handing a glowing domain scroll across a counter under red warning beacons, navy and chrome on aged paper, no text

123 Reg breach: GDPR, NIS and the phishing follow-on

Home » Breaches & Incidents » 123 Reg breach: GDPR, NIS and the phishing follow-on

123 Reg has told customers that an intrusion on 18 September 2026 exposed contact and account data. The company calls it an “AI-driven cyberattack” and says early signs point to a China nexus. The board question is not the marketing label. It is which clocks started, who else may have to file, and how quickly a registrar breach turns into domain hijacks and fake login emails.

What 123 Reg has claimed

According to The Register (opens in a new tab) (28 October 2026), GoDaddy-owned UK registrar 123 Reg notified customers this week that contact information, related customer-relationship data, company VAT numbers and product information from an API were compromised. A company spokesperson told The Register that means names, phone numbers, countries, language and currency preferences, account creation dates, products on the account, and marketing preferences. The email to customers said the attacker’s activity “was limited to reading” customer data; the spokesperson added that copies may have been taken. Passwords were not reported as taken.

123 Reg described the incident as “the first known AI-driven cyberattack against our company.” It told The Register that core attacker infrastructure used IP addresses hosted in China and Singapore, that AI cyberattack “skills” (including copies of Anthropic open-sourced skills) sat on Chinese infrastructure, and that artefacts matched a Chinese state-sponsored group known for abusing Claude Code. It also linked the tooling to ARTEX — an open-source Chinese agentic penetration-testing tool that, 123 Reg told The Register, CrowdStrike’s CSA-261162 (7 October 2026) tied to attacks on South Korean financial organisations. Those attribution points are 123 Reg’s assessment, as reported by The Register — not independent findings of this site. The company says it notified law enforcement, the US Federal Trade Commission, and UK and EU data-protection authorities.

UK GDPR: the 72-hour ICO clock, and Article 34

Under UK GDPR Article 33 (opens in a new tab), a controller must notify the Information Commissioner’s Office of a personal-data breach without undue delay and, where feasible, within 72 hours of becoming aware, unless the breach is unlikely to risk individuals’ rights and freedoms. Incomplete facts are not an excuse: the ICO’s guidance is to report early and update later. If the risk to people is high, Article 34 (opens in a new tab) also requires communication to affected individuals without undue delay. Customer emails that list the fields taken and warn against password or code requests are Article 34 in practice. Boards should record when awareness crystallised, what went to the ICO and when, and why any delay past 72 hours was justified.

NIS Regulations 2018: registrars are usually outside RDSP

The Network and Information Systems Regulations 2018 (opens in a new tab) do not treat a retail domain registrar as a “relevant digital service provider”. RDSPs are online marketplaces, online search engines and cloud computing services (NIS Regulations Part 4; ICO digital-service-providers guidance). Digital-infrastructure operators of essential services cover TLD name registries and DNS resolver or authoritative hosting only above the thresholds in Schedule 2, paragraph 10 (opens in a new tab). A pure retail registrar therefore sits primarily under UK GDPR for a customer-data incident, not under NIS incident reporting, unless it also runs DNS or TLD functions that clear those thresholds. The DNS layer customers depend on can still be critical even when the registrar itself is not an OES.

The Cyber Security and Resilience Bill: MSPs and data centres, not a registrar carve-in

The Cyber Security and Resilience (Network and Information Systems) Bill (opens in a new tab) was introduced on 12 November 2025. As of 27 October 2026 it had completed Lords Report (HL Bill 62 as amended on Report). Government factsheets (opens in a new tab) (updated 30 June 2026) bring medium and large managed service providers and data-centre operators into the NIS framework, tighten incident reporting, and expand duties for relevant digital service providers. They do not create a new “registrar” category. Boards that buy managed DNS, reseller panels or outsourced registry tech should watch the MSP measure: the provider behind the registrar console may enter scope even if the retail brand does not.

GoDaddy, SEC Item 1.05 and the four-business-day clock

123 Reg is GoDaddy-owned. US-listed parents face Form 8-K Item 1.05 (opens in a new tab): once the registrant determines that a cybersecurity incident is material, it must file within four business days of that determination, covering nature, scope, timing and material (or reasonably likely material) impact. Materiality is the issuer’s call, not the subsidiary’s marketing copy. An EDGAR review of GoDaddy Inc. (CIK 0001609711) on 28 October 2026 showed no Item 1.05 filing after the 18 September intrusion; the latest 8-K on the list was 4 August 2026 (Items 1.01, 2.03 and 9.01). That is not proof of immateriality — only that materiality has not been determined, has been rejected, or a filing has not yet landed. Boards of UK subsidiaries of US issuers should assume the parent’s disclosure committee owns the clock.

EU NIS2: DNS and TLDs on the Article 23 clock; registrars on Article 28

Directive (EU) 2022/2555 (NIS2 (opens in a new tab)) treats top-level domain name registries and DNS service providers as essential entities regardless of size (Article 3(1)(b)). Essential and important entities face Article 23’s staggered reports: an early warning within 24 hours, an incident notification within 72 hours, and a final report within one month. Entities providing domain name registration services are in scope of the Directive regardless of size (Article 2(4)), must be listed by Member States (Article 3(3)), and carry the Article 28 duties to maintain accurate registration data and answer lawful access requests within 72 hours. Whether a pure retail registrar also sits on the Article 23 incident clock depends on national transposition and whether it also runs DNS or TLD functions. EU customers and EU establishments of a UK registrar still pull GDPR/NIS2 analysis into the incident room even when the brand is British.

The next blast radius: registrar phishing for SMEs

Contact data from a registrar is useful for one reason: it makes the next email look real. Expect domain-transfer social engineering, fake “verify your account” pages, DNS and MX change notices, and invoice fraud that quotes the products on the account. 123 Reg’s own customer email, as reported by The Register, warned that the company will never ask for passwords, payment details or verification codes by email, text or phone, and urged two-step verification. Boards and SMEs should treat that as the minimum, not the finish line.

  • Registrar lock and transfer lock on every production domain; remove unlock windows from helpdesk scripts.
  • MFA / 2SV on the registrar account, with hardware keys where the panel allows; no shared mailbox as the recovery path.
  • Out-of-band verification for any email that mentions DNS, MX, nameservers, auth codes or payment methods — call a number you already have, not the one in the message.
  • Change alerts for DNS, nameserver and registrant-contact edits; watch TTLs before and after any suspected phishing window.
  • Inventory which staff can approve transfers, and which third parties (agencies, MSPs, web hosts) hold panel access.

The same controls travel. A US or EU SME on any retail registrar faces the same hijack path; UK GDPR, NIS2 and SEC Item 1.05 simply decide who else gets a formal notice when the registrar itself is the patient.

Sources

Follow Cyber-Threat.net RSSFeedly (opens in a new tab)X (opens in a new tab)Bluesky (opens in a new tab)LinkedIn (opens in a new tab)