Anthropic has told business customers of its Claude AI service that some of their account details may have been viewed without authorisation by an outside cybersecurity firm. According to Korean press reports of the notice, sent on 7 November, the data may include names, work email addresses, account and organisation IDs and plan details; one report says usage and spending figures were also involved.
Anthropic says the intruder did not reach customers’ prompts, Claude’s replies or payment information. Access came through a flaw in third-party business software. The Washington Post reported on 26 October that Cathedral, a US security start-up taking part in Anthropic’s outside research programme, got in; Anthropic says the firm did not report all of its activity under the programme’s rules. Anthropic says it blocked the affected systems the day it found the activity, worked with the vendor to fix the flaw and obtained written confirmation that the data was deleted.
In South Korea, Anthropic reported the incident to the Personal Information Protection Commission on 31 October (Hankyung). Korean media say about 100 Korean business accounts are affected. The regulator says the full scale is not yet confirmed and it is reviewing whether to open a formal investigation.
Why it matters: the breach reached an AI company through ordinary business software, not through its AI. Administrators of Claude business accounts should watch for phishing emails that use the exposed names, addresses and plan details.
Source: Hankyung