™Anthropic Reports About 100 Korean Enterprise Accounts Leaked, Regulator Confirms
Anthropic reported to South Korea's Personal Information Protection Commission on Oct 31 that information from about 100 Korean Claude Enterprise accounts had leaked; the commission confirmed on Nov 9 that it had received the report and is conducting a preliminary review, with no formal investigation opened.
What happened
The commission said on Nov 9 that it had received Anthropic's report filed on Oct 31 and is conducting a preliminary review, without deciding whether to open a formal investigation. It said it would confirm the specific scale of the damage once a formal investigation begins.
The information potentially exposed includes names, email addresses, account IDs, organization IDs, plan tiers, and usage and spending figures. Anthropic began emailing enterprise customers on Nov 7. An Anthropic researcher wrote on X on Nov 8 that prompts, AI outputs and payment information were not accessed.
The incident began on Oct 8, when Cathedral, a US cybersecurity startup, exploited a vulnerability in third-party office software to enter Anthropic's internal systems without authorization; the access was discovered and cut off on Oct 10. The Washington Post first reported the intrusion on Oct 26. According to multiple outlets, Cathedral was founded by four former members of the US Department of Government Efficiency.
Key facts
- Report date: Anthropic reported the leak to South Korea's Personal Information Protection Commission on Oct 31
- Regulator response: The commission confirmed on Nov 9 that it had received the report and is conducting a preliminary review, with no formal investigation opened
- Scope: About 100 Korean Claude Enterprise accounts
- Potentially exposed: Names, email addresses, account IDs, organization IDs, plan tiers, and usage and spending figures
- Reportedly not reached: Prompts, AI outputs, passwords and payment information
- Intrusion timeline: Cathedral entered the internal systems without authorization on Oct 8; the access was discovered and cut off on Oct 10
- Entry point: A vulnerability in third-party office software
- Customer notice: Anthropic began emailing enterprise customers on Nov 7
- First report: The Washington Post first reported on Oct 26 that Cathedral had accessed Anthropic's internal systems
Why it matters
contact and usage data from about 100 enterprise accounts leaked after an outside security firm entered Anthropic's internal systems without authorization, while prompts and payment information were reportedly not reached.
CompaniesAnthropic
Follow HIMIAO Horizon
No sign-up · Unsubscribe any timeNotifications
A ping on your phone or computer when the brief is out. No email needed.
Comments
Related
- Nov 9Anthropic Launches Claude Enterprise Security Center; Inference Hooks Go GA
- Nov 1Trojanized Claude Code Extension Hit Cursor's Marketplace, Affecting Up to 5,000 Developers
- Oct 26Claude Accessed Georgia Voter Data Without Authorization, Bypassing a Paywall During Training
- Oct 24Anthropic Has Claude Write Formal Proofs for 123 Open-Source Libraries
- Oct 13Anthropic Says Anti-Distillation Safeguards Cut Extraction by 90% or More
Today
Nov 10 Tuesday- Brief
- GitHubGitHub Weekly Vol.5: 6 Projects Worth a Look This Week
Tested or read — weeklyAll →
- Quiz
- Call
Latest news
All →- Nov 10Hardware AI Platform Nominal Raises $240M Series C at $3B Valuation
- Nov 10ChatGPT Enterprise Lands on AWS Marketplace, Payable on AWS Billing
- Nov 10SpaceX Plans $24 Billion Supercomputer Hub at Starbase With Its Own Gas Plant
- Nov 10Meta Launches Muse Ember, Its Smallest and Cheapest Agent Model
- Nov 9Anthropic Launches Claude Fable 5.2 and Mythos 5.2
- Nov 9Oxford Study: Frontier AI Agents Struggle to Coordinate With Strangers