2026 123 Reg — intrusion described as an AI-driven cyberattack exposed customer names, contact details and account records; count not disclosed
Data compromised
Names, phone numbers, countries, language and currency settings, account dates, products, marketing preferences and VAT numbers. The company says the attacker's access was limited to reading data, although copies may have been made. Passwords and payment data are not listed among the exposed fields. No count has been published.
Technical writeup
Source is The Register's report of the customer notice, quoting the company. No standalone company notice was found.
Root cause
123 Reg says the intrusion began on September 18, 2026, and calls it the first known AI-driven cyberattack against the company. It has said it suspects a China-linked actor, but that is the company's suspicion only; no attribution has been confirmed.