123 Reg lost customer data. Expect convincing emails about your domain.
Your business domain is the thing your email, your website, and most of your password resets hang off. Whoever controls the account at the company you registered it with controls all of that. If your domains are with the UK registrar 123 Reg, you should have had an email from it this week saying that an intruder read customer data.
What was taken will not unlock your account by itself. It will make the next fake email about your account far more convincing, and that is what to prepare for.
What 123 Reg says happened
123 Reg, which is owned by GoDaddy, told The Register that the intrusion happened on 18 September. According to the company, the attacker could see:
- names, phone numbers, and countries
- company VAT numbers
- account creation dates
- which products each customer holds
- language, currency, and marketing preferences
Its email to customers says the activity "was limited to reading" the data, but its spokesperson said "it's possible they created copies", which is why customers are being told. Passwords and payment details are not on that list. 123 Reg has reported the incident to law enforcement and to the UK and EU data protection regulators.
The company describes it as an AI-driven attack and suspects a group linked to China. For a customer, who did it matters much less than what they now know.
Why the data matters
A phishing email usually gives itself away by being generic. This data removes the generic part. Someone holding it knows that you are a 123 Reg customer, which products you pay for, roughly when you signed up, your phone number, and your VAT number.
That is enough to write a message that reads exactly like a real renewal reminder or a security check: "Your domain and hosting package for your business are due to expire. Confirm your details to avoid losing your website." It is also enough for a phone call that sounds as if it comes from support, because the caller can quote your account details back to you.
The prize is the registrar login. With it, an attacker can point your domain somewhere else, read or redirect your email, or move the domain to another registrar. We wrote about how fast that can go wrong when GoDaddy handed a 27-year-old domain to a stranger in four minutes.
What to do if your domains are with 123 Reg
Turn on two-step verification on the 123 Reg account today. That is the extra code from an app or text after your password. 123 Reg is recommending it too, and the instructions are in the account settings. It is the single change that most limits what a stolen password can do.
Never act on a link or a call. 123 Reg says it will never ask for your password, payment details, or verification codes by email, text, or phone. If a message worries you, type the address into your browser yourself and log in from there.
Turn on the registrar lock. It stops a domain being transferred away without an extra unlock step. It is sometimes called a transfer lock.
Tell whoever handles your bills. A fake renewal invoice is the most likely follow-up, and it will usually land with whoever pays them, not with whoever runs IT. One line is enough: "123 Reg will never ask us to confirm card details or codes. Check with me first."
What to check, whoever your registrar is
This is a good moment to answer three questions most businesses never have:
- Who holds the login to our domain account, and does it use an address we still control? If an agency or a former colleague set it up years ago, take it back.
- Is two-step verification on, and is the registrar lock on for every domain we care about?
- When do our domains renew, and do the renewal emails reach someone who will read them? A domain that lapses can be bought by someone else.
If you also publish the records that say who may send email as you, SPF, DKIM, and DMARC, a stranger will find it harder to send convincing email in your name when the next breach happens somewhere else.
How Steelwise can help
Working out where your domains are registered, who can log in, and what would happen if that account were taken over is a short review that pays for itself the first time something goes wrong. Get in touch and we will help you check.