GoDaddy and UK domain registrar 123 Reg have disclosed cyber incidents dating back to 18 September 2026, with customer notifications arriving more than a month later. The incidents raise concerns about the use of AI-assisted attack techniques against the infrastructure businesses rely on to manage websites and domains.
Two major web hosting and domain service providers have disclosed customer data exposures following what both companies described as AI-driven cyberattacks.
GoDaddy and its UK-based registrar subsidiary 123 Reg began notifying customers in late October about incidents that occurred on 18 September 2026. Both incidents involved unauthorised access to customer information through application programming interfaces (APIs), although the precise attack methods and extent of the compromise differ in the available reporting.
The disclosures highlight the growing security challenges facing providers that underpin websites, online businesses and domain management services.
GoDaddy confirms website customer information exposed
GoDaddy disclosed that an attacker accessed profile, settings and contact information associated with its Websites + Marketing product.
According to the company’s notification, the incident occurred on 18 September and was detected the following day. The attacker accessed information through an API, including contact details customers had supplied for publication on their websites.
GoDaddy said its investigation found that the unauthorised activity was limited to reading the exposed information. The company reported no evidence that the attacker obtained customer passwords, accessed customer accounts, modified websites or took other actions affecting customer products.
The company described the incident as its first known AI-driven cyberattack and said it had engaged cybersecurity specialists, worked with industry partners, reported the incident to law enforcement and notified relevant data protection authorities.
GoDaddy also warned customers that exposed contact information could be used in subsequent phishing attempts. Customers receiving unexpected emails, text messages or phone calls claiming to come from GoDaddy should verify them independently rather than disclose credentials or payment information.
Source: VINnews — GoDaddy says AI-driven cyberattack exposed website customer information
123 Reg reports customer data exposure and possible China nexus
UK domain registrar 123 Reg also disclosed an incident dating to 18 September. The company, which is owned by GoDaddy, said the attack exposed customer contact information, related customer relationship data, company VAT numbers and product information obtained through an API.
Information identified in reporting by The Register includes customer names, phone numbers, countries, language and currency preferences, account creation dates, products associated with accounts and marketing preferences.
123 Reg said the attacker’s activity was limited to reading customer data, although the company acknowledged that copies of the information may have been created.
The investigation has also raised questions about the possible origin of the attack. 123 Reg told The Register that infrastructure associated with the activity was hosted in China and Singapore, and that investigators identified AI-related attack tools and frameworks on Chinese infrastructure.
The company said these findings suggested a possible China-linked threat actor. It also raised the possibility of a connection to an actor associated with attacks against South Korean financial organisations. These are investigative assessments, not confirmation of the attacker’s identity or state sponsorship.
123 Reg reported the incident to law enforcement, engaged external cybersecurity specialists and notified relevant regulatory authorities. It also said it worked with internet service providers in Singapore to disrupt attacker infrastructure.
Source: The Register — 123 Reg discloses AI cyberattack on customer data, suspects China nexus
Why these incidents matter
Domain registrars and website hosting providers occupy an important position in the digital supply chain. Their platforms support businesses of all sizes, including organisations that may have limited visibility into the security controls protecting the services they use.
Even when an incident does not result in stolen passwords or direct control of a website, customer information can provide attackers with valuable material for follow-on operations.
Potential consequences include:
- Targeted phishing: Names, phone numbers, product details and account information can make fraudulent communications more convincing.
- Account-related scams: Attackers may impersonate a provider’s support team and use genuine account details to establish credibility.
- Business impersonation: Information about hosted websites and customer relationships can help attackers identify organisations and tailor their approaches.
- Supply-chain exposure: A compromise at a shared service provider can affect customers across many industries, rather than a single organisation.
The incidents also demonstrate why API security deserves particular attention. APIs often provide legitimate, automated access to customer and product information. If access controls, authorisation checks or monitoring are inadequate, an attacker may be able to extract information without needing to take over a customer’s account.
What does AI-driven mean in this context?
The term AI-driven cyberattack is increasingly being used to describe attacks in which artificial intelligence or AI-enabled tools assist with activities such as reconnaissance, vulnerability discovery, exploitation or the automation of attack workflows.
In the 123 Reg case, the company reported finding AI-related tools and infrastructure that informed its assessment of the incident. The available reporting does not establish that every stage of either attack was performed autonomously, nor does it provide enough detail to independently reconstruct the complete attack chain.
It is therefore important to distinguish between the confirmed outcome — unauthorised access to customer data — and the companies’ characterisation of the techniques used.
Regardless of how much AI was involved, the underlying security questions remain familiar: how the attacker obtained access, whether API authorisation controls were effective, how unusual data access was detected and how quickly the activity was contained.
What customers should do
Customers of GoDaddy, 123 Reg and other domain or hosting providers should take the following precautions:
- Enable two-step verification (2SV/MFA) on registrar, hosting and administrator accounts.
- Be alert for targeted phishing, particularly messages referencing genuine domains, products, invoices or account details.
- Verify support requests independently. Navigate directly to the provider’s official website instead of following links in unexpected messages.
- Never disclose passwords, payment details or verification codes in response to unsolicited communications.
- Review account security and recovery settings, including administrator access and recovery email addresses.
- Limit unnecessary public contact information on websites and review what information is exposed through customer profiles and other services.
Organisations should also review the security of their wider digital supply chain, including the providers responsible for domain registration, DNS, website hosting and business-critical online services.
Conclusion
The GoDaddy and 123 Reg disclosures are a reminder that attackers do not always need to encrypt systems or take control of accounts to create meaningful security risks. Access to customer and account-related information can be enough to support highly targeted fraud and phishing campaigns.
Although both incidents have been described as AI-driven, the extent of AI’s role remains incompletely documented in public reporting. The more immediate lesson for organisations is to treat registrar and hosting accounts as critical business assets, enforce strong authentication, scrutinise API security and prepare for the possibility that legitimate customer information could be used against them.
For customers in New Zealand and Australia, notifications from international providers are also a prompt to review the security of the third-party services on which their websites and online operations depend.
