Их Британийн домэйн бүртгэгч 123 Reg компани хиймэл оюун ухаанд суурилсан кибер халдлагад өртөж, хэрэглэгчдийнхээ хувийн мэдээллийг алдсанаа хүлээн зөвшөөрөв.
Есдүгээр сарын 18-нд бүртгэгдсэн уг халдлагын улмаас хэрэглэгчдийн нэр, утасны дугаар, улс орон, хэл болон валютын тохиргоо, данс үүсгэсэн огноо, бүтээгдэхүүний мэдээлэл, компанийн НӨАТ-ын дугаар зэрэг өгөгдөл эрсдэлд оржээ. Тус компани энэ нь тэдний системд хандсан анхны хиймэл оюун ухаан ашигласан халдлага болохыг мэдэгдсэн байна. 123 Reg-ийн мөрдлөгийн урьдчилсан дүнгээр халдлага үйлдэгчид Хятад болон Сингапурт байрлах серверийг ашигласан нь тогтоогджээ.
Тус компани халдлага үйлдэгчид Anthropic-ийн нээлттэй эх сурвалж бүхий “anthropic_skills” болон бусад хиймэл оюун ухааныг ашиглах скриптүүдийг ашигласан гэж үзэж байна. Мөн 2026 оны долдугаар сард гарсан ARTEX хэмээх Хятадын нээлттэй эх сурвалжийн хиймэл оюун ухааны хэрэгслийг Өмнөд Солонгосын санхүүгийн байгууллагууд руу довтлоход ашигласантай ижил бүлэглэл энэхүү халдлагыг үйлдсэн байж болзошгүй гэсэн таамаг дэвшүүлжээ.
123 Reg компани уг асуудлыг хууль сахиулах байгууллагууд, Их Британи болон Европын холбооны мэдээлэл хамгаалах албад, мөн АНУ-ын Холбооны худалдааны комисст (FTC) мэдэгдсэн байна. Халдлага үйлдэгчид мэдээллийг зөвхөн уншсан байх магадлалтай боловч мэдээллийн хуулбарыг үүсгэсэн байх эрсдэлтэй тул хэрэглэгчдэд анхааруулга хүргүүлжээ.
Компани хэрэглэгчдээс сэжигтэй мессеж болон дуудлагад болгоомжтой хандахыг хүсэж, дансны аюулгүй байдлаа хангах үүднээс хоёр хүчин зүйлийн баталгаажуулалт (2SV) идэвхжүүлэхийг зөвлөв. Мөн 123 Reg хэзээ ч хэрэглэгчээс нууц үг, төлбөрийн мэдээлэл эсвэл баталгаажуулах код шаардахгүй болохыг санууллаа.
Дэлгэрэнгүйг эх сурвалжаас харах
↓Эх сурвалжийг нээх ↓
UK domain registrar 123 Reg (no relation – Ed) says it was the victim of an “AI-driven cyberattack” that exposed customer data. Customers began receiving their notification emails this week, informing them that their contact information, “related customer relationship data,” company VAT numbers, and “product information from an application programming interface (API)” were compromised. A company spokesperson elaborated, saying this means that names, phone numbers, countries, language and currency preferences, account creation dates, the products on the account, and marketing preferences were affected. 123 Reg described the September 18 intrusion as “the first known AI-driven cyberattack against our company,” and told The Register that early signs point toward a China-nexus attacker. “Our investigation identified IP addresses that we assessed to be the core attacker infrastructure, which were hosted in China and Singapore, indicating a strong Chinese nexus,” the spokesperson said. “Our investigation further identified AI cyberattack ‘skills’ hosted on Chinese infrastructure, including copies of skills open sourced by Anthropic and several other AI exploitation frameworks and scripts.” They went on to say that many of the artefacts left behind led 123 Reg to suspect that a Chinese state-sponsored group, known for abusing Claude Code in attacks against at least 30 organizations, could be behind the break-in. There is also a suspicion that the same group that hit a number of South Korea’s financial institutions using open-source Chinese AI tool ARTEX, was behind the attack on 123 Reg too. “The TA’s mirror of ‘anthropic_skills,’ and the account naming conventions found on the Chinese servers are consistent with preparation of this class of AI-augmented operation,” the spokesperson told us. “In addition, on October 7, 2026, CrowdStrike published CSA-261162, describing an unknown, likely Chinese-speaking actor that targeted several South Korean financial organizations starting in late September 2026, which is the same period during which we were attacked. “That actor used ARTEX, an open-source Chinese-developed agentic penetration-testing tool released in July 2026, which was also observed to be used in the attack that targeted us.” The GoDaddy-owned registrar reported the attack to law enforcement agencies, brought in outside cybersecurity support, and notified the FTC, as well as the data protection authorities in the UK and EU. The company spokesperson added that it worked with Singapore-based ISPs to shut down the attacker’s servers in the region, which helped disrupt the attack, in addition to “other actions by us and industry partners.” 123 Reg’s email to customers stated the attacker’s activity “was limited to reading” customer data, although the spokesperson told us “it’s possible they created copies of the information,” and that this is what prompted the notification. The registrar urged customers to stay alert to the potential misuse of their data, and to treat communications appearing to come from the company with caution. “If you receive a message or call and aren’t sure it’s from 123 Reg, go directly to our website and log in,” the email said. “We will never contact you to request your password, payment details, or verification codes by email, text, or phone. “We also strongly recommend turning on two-step verification (2SV), which helps keep your account protected even if someone tricks you into sharing your password. You can find instructions for setting up 2SV in your 123 Reg account. “We apologize for any inconvenience this may have caused.” ®
