123 Reg data breach: what to do about follow-up scams
Share
As at 30 October 2026.
If you've had 123 Reg's email about its data breach, in our view the more practical risk now is the scam messages and calls that can follow. 123 Reg says the attacker read customer data and may have copied it. It recommends turning on two-step verification (2SV) and going straight to its website to log in if you're not sure a message or call is from 123 Reg.
What happened in the 123 Reg data breach?
123 Reg is a UK domain registrar owned by GoDaddy. On 28 October 2026, The Register reported that its customers had started getting emails about an intrusion on 18 September 2026. According to that report, the details involved include names, phone numbers, countries, language and currency preferences, account creation dates, the products on the account, marketing preferences and company tax registration numbers.
123 Reg's email to customers said the attacker's activity "was limited to reading" customer data. A spokesperson told The Register that "it's possible they created copies of the information", and that this is why customers were told. 123 Reg describes it as an AI-driven attack and suspects a China-linked group. That's the company's own assessment. The report doesn't give a number of customers affected.
Why do scam emails and calls follow a data breach?
The NCSC explains that criminals use information from a breach to make phishing messages look genuine. They may even pretend to be the organisation that was breached. Where phone numbers are involved, you might get a suspicious call as well. These messages can arrive some time after the breach is made public.
The NCSC also says criminals exploit high-profile breaches even when your own details weren't taken. So if you're not a 123 Reg customer, the same care applies to messages about any recent breach.
Because the details listed include the products on the account, a scam message could mention a service you really do pay for. That makes it harder to spot. The NCSC lists some signs to look out for:
- genuine-sounding messages about "resetting passwords", "receiving compensation", "scanning devices" or "missed deliveries"
- emails full of technical jargon, written to sound more convincing
- pressure to act at once or by a deadline
How do I turn on two-step verification on my 123 Reg account?
123 Reg's email to customers, as quoted by The Register, says: "We also strongly recommend turning on two-step verification (2SV), which helps keep your account protected even if someone tricks you into sharing your password. You can find instructions for setting up 2SV in your 123 Reg account."
The NCSC says 2SV helps to keep criminals out of your accounts even if they know your password. Where a service offers it, the option is usually in the account's security settings. It may be called two-factor authentication (2FA) or multi-factor authentication (MFA).
It's worth doing the same for your email account. The NCSC recommends 2SV on your most important accounts, such as email, banking, social media and online shopping.
How can I tell if a message really is from 123 Reg?
123 Reg's email says: "If you receive a message or call and aren't sure it's from 123 Reg, go directly to our website and log in." It also says: "We will never contact you to request your password, payment details, or verification codes by email, text, or phone."
The NCSC gives the same advice for any breach. Contact the organisation through its own website, and don't use the links or contact details in a message you've been sent. So if you need 123 Reg's contact details, type its web address in yourself rather than replying to the message.
What should I check on my other accounts?
After a breach, the NCSC suggests these steps:
- If a suspicious message quotes a password you've used, change it if you still use it, along with any other account that shares it. Where a passkey is offered, you could use one instead.
- Check your accounts for anything you don't recognise: being unable to log in, changes to your security settings, messages sent from your account, or logins from strange places or at unusual times.
- If you think an account has been accessed, follow the NCSC's guidance on recovering a hacked account.
Where do I report a scam message or call?
| What you've had | What to do (NCSC) |
|---|---|
| A suspicious email | Forward it to report@phishing.gov.uk |
| A suspicious text message | Forward it to 7726 |
| A nuisance or suspicious call | Hang up and contact your phone provider |
| You've lost money or been hacked (England, Wales or Northern Ireland) | If you've lost money, tell your bank. Report it to Report Fraud at reportfraud.police.uk or on 0300 123 2040 |
| You've lost money or been hacked (Scotland) | If you've lost money, tell your bank. Call Police Scotland on 101 |
Checklist for 123 Reg customers
- Turn on 2SV in your 123 Reg account.
- Turn on 2SV on the email account your 123 Reg login uses.
- Log in to 123 Reg by typing its address yourself, not through a link.
- Remember that 123 Reg says it never asks for your password, payment details or verification codes by email, text or phone.
- Check your accounts for changes you didn't make.
- Report suspicious emails to report@phishing.gov.uk and texts to 7726.
Frequently asked questions
How many 123 Reg customers were affected?
The Register's report of 28 October 2026 doesn't give a number.
Will 123 Reg ask for my password or a verification code?
No. 123 Reg's email says it will never contact you to ask for your password, payment details or verification codes by email, text or phone.
I'm not a 123 Reg customer. Does this affect me?
Your details may not be involved, but the NCSC says criminals use high-profile breaches to send scam messages to people whose details weren't taken. The same checks apply.
What is two-step verification?
It's a second check when you sign in, such as a code, an app, or a fingerprint or face scan. The NCSC says it helps keep criminals out of your accounts even if they know your password.
Lock down the rest of your accounts
The Account Lockdown Kit takes you through your email, phone and main online accounts in order: passkeys and 2SV, a recovery codes worksheet, a breach check, and a "Hacked? The first 30 minutes" card with UK reporting routes. It doesn't cover 123 Reg's own settings, which are in your 123 Reg account.
Related: Business email hacked? What to do in the first hour (UK).
Sources
- The Register, "123 Reg discloses 'AI cyberattack' on customer data, suspects China nexus", 28 October 2026: https://www.theregister.com/cyber-crime/2026/10/28/123-reg-discloses-ai-cyberattack-on-customer-data-suspects-china-nexus/5305936 (accessed 30 October 2026)
- NCSC, Data breaches: guidance for individuals and families: https://www.ncsc.gov.uk/guidance/data-breaches (accessed 30 October 2026)
- NCSC, Turn on 2-step verification (2SV): https://www.ncsc.gov.uk/collection/top-tips-for-staying-secure-online/activate-2-step-verification-on-your-email (accessed 30 October 2026)
- NCSC, Report a scam email: https://www.ncsc.gov.uk/collection/phishing-scams/report-scam-email (accessed 30 October 2026)
General guidance, not legal or personalised security advice. Secordit Intelligence has no connection with 123 Reg or GoDaddy.
