GoDaddy’s 123 Reg “AI-Driven” Attack: Exposed Data and Risks

GoDaddy did not disclose evidence that its entire global customer base was breached. The incident involved 123 Reg, a UK domain registrar owned by GoDaddy. According to 123 Reg’s reported customer notice, attackers entered its systems on September 18, 2026, and accessed customer and product information through an application programming interface, or API. Customers began receiving notifications during the week of October 26, about 40 days after the intrusion. (The Register; VINnews)

The exposed information reportedly included names, telephone numbers, countries, language and currency preferences, account-creation dates, products held, marketing preferences, company VAT numbers, and related customer-relationship data. The available reporting indicates that attackers read information rather than alter websites, access customer accounts, or disrupt products. But 123 Reg also acknowledged that attackers may have created copies of the information. (The Register)

That distinction matters. Data theft can create phishing and impersonation risks even when passwords are not exposed. A criminal who knows a customer’s name, business details, products, account-creation date, and contact information may be able to make a fraudulent message look as if it came from a registrar, hosting provider, supplier, or colleague.

The incident also raises a more difficult question: what does “AI-driven cyberattack” actually mean? The evidence currently supports the use of AI-enabled or agentic tools during the operation. It does not yet prove that artificial intelligence made the attack autonomous, that it enabled a capability unavailable to conventional attackers, or that a specific Chinese state group carried out the intrusion.

What happened on September 18?

The reported intrusion began on September 18, 2026. The available account indicates that attackers accessed a 123 Reg API used to retrieve customer and product records. The system apparently returned data that the attackers were not authorized to obtain. (VINnews)

An API is a software interface that allows one system to request information or perform an action in another system. In an ordinary customer-management platform, an API might allow a website, support tool, billing system, or internal application to retrieve details about an account. If authentication, authorization, rate limiting, and monitoring fail, an attacker may be able to send repeated requests and extract records without needing to break into the underlying database directly.

The publicly available material does not establish precisely when 123 Reg detected the intrusion. It indicates that the company investigated activity connected to the September 18 event and began notifying affected customers during the week of October 26. The interval between the reported intrusion and the beginning of notification was therefore roughly 40 days, although the dates do not show exactly when the company confirmed the scope of the incident.

The current evidence also does not establish how many customers were affected. No reliable figure appears in the supplied incident reporting, and no regulator notice or company document supplied here provides a confirmed count. That number should not be guessed from GoDaddy’s total customer base.

What information was exposed?

The reported data set was broader than a simple list of email addresses. The information may have included:

• Names
• Telephone numbers
• Countries
• Language preferences
• Currency preferences
• Account-creation dates
• Products held
• Marketing preferences
• Company VAT numbers
• Other customer-relationship information

(The Register)

The available reporting does not establish that attackers obtained passwords, payment-card numbers, bank credentials, private encryption keys, or complete identity documents in this incident. It also does not establish that every affected customer had every listed field exposed. “May have been accessed” is not the same as proof that each record contained each category of information.

The scope of the incident also remains important. The evidence identifies 123 Reg, not every GoDaddy brand or service. It does not establish that GoDaddy’s broader global customer database was exposed, nor that GoDaddy hosting, Managed WordPress, Microsoft 365, or other products were affected by the same event.

Why the API matters

The reported attack appears to have been a data-extraction event. The attackers used an API to read customer and product records. There is no evidence in the material that they modified websites, entered customer accounts, or disrupted domain and hosting services. (VINnews)

Several controls are designed to limit this kind of abuse:

• Strong authentication for API clients and users
• Authorization checks that verify whether a requester may access a particular record
• Rate limiting to restrict rapid or repeated requests
• Logging and anomaly detection
• Traffic monitoring
• Network segmentation
• Restrictions on trusted connections
• Separation between read and write functions

The Federal Trade Commission’s 2025 action against GoDaddy identified several of these controls as areas of concern in earlier incidents. The FTC alleged deficiencies involving asset management, software updates, risk assessment, logging, monitoring, network segmentation, and API protections. Its final order required a comprehensive information-security program, stronger session authentication, API rate limiting, traffic monitoring, recurring risk assessments, and phishing-resistant multifactor authentication options. (FTC complaint; FTC final order; Federal Register notice)

Those controls are directly relevant to an API-based data theft. But the available evidence does not show which specific safeguard failed in the September incident. It also does not establish that the 2025 FTC order caused, permitted, or failed to prevent this particular intrusion.

Where this story sits

5 related pieces

Hover a story · click to read

1. No. 75 · Oct 21, 2026Are Banks Hiding Security Risks That Could Put Your Money at Risk? Inside the ARTEX Breach
2. No. 78 · Oct 22, 2026The Election Machine: How Campaigns Turn Data Into Your Political Feed
3. No. 55 · Sep 24, 202610 Gigawatts Overhead: The Orbital Data Centers the FCC Reviews One Filing at a Time
4. No. 36 · Sep 5, 2026The Army Is Turning Military Land Into an AI Compute Platform
5. No. 17 · Aug 27, 2026The Kidnappers Outsmart Nigeria’s Surveillance State

What does “AI-driven” mean here?

123 Reg reportedly described the event as its first known AI-driven cyberattack. Investigators found artifacts that the company associated with AI exploitation frameworks, open-source “skills,” and ARTEX, an agentic penetration-testing tool developed in China. (The Register)

Agentic cybersecurity tools can automate sequences that previously required an attacker to perform manually. Depending on their configuration, such tools may help identify exposed services, select exploitation steps, issue commands, move through systems, and organize stolen information. The use of an AI-enabled framework may allow an attacker to run reconnaissance and exploitation workflows faster or with less direct human input.

That does not automatically make an attack autonomous. It does not show that an AI system independently selected the target, found the API flaw, or made strategic decisions without human direction. The public account does not provide logs, code, forensic indicators, or a technical report sufficient to measure how much of the operation AI performed.

Microsoft separately reported that a China-aligned actor it calls Storm-0940 used ARTEX in attacks beginning in September 2026, including a ConnectWise supply-chain compromise. (Microsoft Security)

That report creates a possible connection, but not proof that Storm-0940 attacked 123 Reg. The evidence does not show that the 123 Reg attackers used the same accounts, servers, malware, command infrastructure, or operational identifiers. AhnLab also cautioned that the geographic location of ARTEX-related IP addresses cannot identify an operator’s nationality or prove that every host was controlled by an attacker. (AhnLab ASEC)

The strongest defensible description is therefore narrower: investigators linked the 123 Reg intrusion to artifacts associated with ARTEX or similar AI-enabled tooling, while the identity of the operator remains unconfirmed.

Could the exposed data be used for fraud?

Yes, although the risk is more likely to involve targeted deception than immediate account takeover.

Exposed contact and account information can help criminals create messages that refer to a real product, a real company, or a plausible account event. A fraudulent message could claim that:

• A domain is about to expire
• A hosting subscription requires payment
• An SSL certificate needs to be renewed
• A website has been suspended
• An invoice contains an error
• A security check requires a password reset
• A business account needs urgent verification

The combination of a business name, telephone number, product information, currency preference, and account-creation details can make such a message more credible. Security researchers have previously warned that information connected with hosting accounts and websites can support business impersonation, payment redirection, and voice-phishing attempts. (SC Media)

The available evidence does not establish that the 2026 123 Reg incident has already produced fraudulent invoices, identity theft, or account takeovers. Those are plausible risks, not documented outcomes in the material reviewed here.

The risk of password compromise also remains unproven in the other direction. The available reporting indicates that there is no evidence of password access or customer-account access. That would reduce the likelihood of direct account takeover, but it would not eliminate phishing, password-reset attacks, or attempts to trick customers into disclosing credentials.

Why did notification take about 40 days?

The reported intrusion occurred on September 18, while customer notifications began during the week of October 26. That creates an interval of roughly 40 days. (The Register)

The available evidence does not explain the full timeline. A company may need time to identify the affected system, determine what records were available, establish whether data was copied, preserve forensic evidence, and identify the people or organizations who must be notified. Those investigative steps do not, by themselves, establish whether a notification was timely or legally sufficient.

Notification obligations vary according to the customers’ locations, the type of information involved, the applicable privacy law, and whether the event meets a jurisdiction’s breach threshold. The material does not identify the affected customer count, all relevant jurisdictions, or the precise legal notices filed. It is therefore not possible to determine from the current evidence whether every applicable notification requirement was met.

Does GoDaddy’s previous security history matter?

It provides context, but it does not prove that the latest incident resulted from the same weakness.

GoDaddy’s SEC filings describe earlier incidents involving hosting credentials, Managed WordPress environments, and cPanel systems. The filings refer to an incident involving approximately 28,000 hosting accounts and a later Managed WordPress compromise affecting up to 1.2 million active and inactive customers. (GoDaddy SEC filing; GoDaddy annual filing)

The FTC’s 2025 complaint alleged that earlier security failures included exposed credentials, inadequate access controls, weak monitoring, insufficient segmentation, and problems protecting hosted websites and customer data. The agency’s final order required GoDaddy to improve its security program and API protections. (FTC complaint; FTC final order)

Those records make API authorization, monitoring, and rate limiting important questions in the 123 Reg investigation. They do not establish that GoDaddy violated the FTC order in this incident, that the order covered every 123 Reg system, or that the same technical defect caused both events.

What should affected customers do now?

Customers who receive a 123 Reg notification should treat unexpected messages about domains, hosting, payments, certificates, or account security as suspicious.

The safest steps are:

1. Visit 123 Reg or GoDaddy by typing the address into your browser or using a known bookmark. Do not use links in an unsolicited notification.
2. Change the password for the affected account if it has been reused elsewhere.
3. Change the password for the email account associated with the registrar account, especially if that password was reused.
4. Enable two-step verification or multifactor authentication where available. GoDaddy describes two-step verification as an additional barrier beyond a password. (GoDaddy help)
5. Review account activity, domain settings, payment details, API keys, recovery information, and authorized users.
6. Contact the registrar through an independently verified support channel if a message asks for payment, a password, a security code, or a domain transfer.
7. Warn colleagues who handle invoices, domains, hosting, and website administration.
8. Watch for callers who already know the company name, products, or account-creation details. Familiar details do not prove that the caller is legitimate.
9. Review email-forwarding rules and administrator access if the business uses related email or hosting services.
10. Report suspected fraud to the relevant payment provider, registrar, law-enforcement agency, or data-protection authority.

GoDaddy’s own account-recovery guidance advises customers with suspected compromise to change account and associated-email passwords, consider multifactor authentication, and inspect API keys in the developer portal. (GoDaddy account-security guidance)

The current evidence supports treating the incident as a serious exposure of business and customer-profile information. It does not support saying that all GoDaddy customers were breached, that passwords were stolen, or that a Chinese state actor has been conclusively identified. The central risk is more specific: attackers may have obtained enough authentic information to make later fraud attempts look trustworthy.

Sources / References

• The Register, “123 Reg discloses ‘AI cyberattack’ on customer data, suspects China nexus,” October 28, 2026. https://assets.theregister.com/2026/10/28/20268/
• VINnews, “GoDaddy Says AI-Driven Cyberattack Exposed Website Customer Information,” October 28, 2026. https://vinnews.com/2026/10/28/godaddy-says-ai-driven-cyberattack-exposed-website-customer-information/
• Federal Trade Commission, “FTC Finalizes Order with GoDaddy over Data Security Failures,” May 21, 2025. https://www.ftc.gov/news-events/news/press-releases/2025/05/ftc-finalizes-order-godaddy-over-data-security-failures
• Federal Trade Commission, GoDaddy complaint. https://search.ftc.gov/system/files/ftc_gov/pdf/2023133_godaddy_complaint.pdf
• Federal Trade Commission, GoDaddy decision and order. https://search.ftc.gov/system/files/ftc_gov/pdf/2023133_godaddy_decisionandorder.pdf
• Federal Register, Vol. 90, No. 29, February 13, 2025. https://www.govinfo.gov/content/pkg/FR-2025-02-13/pdf/FR-2025-02-13.pdf
• U.S. Securities and Exchange Commission, GoDaddy 2023 Form 10-Q filing. https://www.sec.gov/Archives/edgar/data/1609711/000160971123000082/gddy-20230331.htm
• GoDaddy, annual filing discussing cybersecurity incidents. https://www.sec.gov/Archives/edgar/data/1609711/0009711/000971124000065/godaddy_arsfiling.pdf
• Microsoft Security, “AI-driven, large-scale nation-state campaign using ARTEX enables supply chain compromise,” October 21, 2026. https://www.microsoft.com/en-us/security/blog/2026/10/21/storm-0940-uses-artex-agentic-ai-connectwise-supply-chain-compromise/
• AhnLab ASEC, “The Threat of AI-Driven Autonomous Penetration Testing, as Examined by ARTEX.” https://asec.ahnlab.com/en/95845/
• SC Media, “GoDaddy scam shows how voice phishing can be more deceptive than email schemes.” https://www.scworld.com/news/godaddy-scam-shows-how-voice-phishing-can-be-more-deceptive-than-email-schemes
• GoDaddy, “Set up passwords and 2-step verification.” https://help-center.dc-aws.godaddy.com/help/set-up-passwords-and-2-step-verification-40158
• GoDaddy, “Lock down a compromised GoDaddy account.” https://www.godaddy.com/en-in/help/lock-down-a-compromised-godaddy-account-6966