South Korean Companies Hit by Leak of Anthropic Claude Account Data
A reported security incident involving Anthropic’s Claude platform has raised concerns over the exposure of corporate customer data in South Korea. The incident is said to have affected 112 corporate accounts, with information including account identifiers, subscription details, and platform usage metrics potentially compromised.
What happened?
Anthropic reportedly submitted a breach notification to South Korea’s Personal Information Protection Commission on 31 October 2026, following the discovery of unauthorized access to its systems by an external security firm.
The exposed information included internal account and organization identifiers, customer subscription tiers, and usage and expenditure metrics.
How the breach occurred?
According to the available details, the unauthorized access involved a vulnerability that allowed the external party, reportedly the US-based startup Cathedral, to retrieve internal customer data.
Anthropic said it promptly revoked the firm's access and deployed a security patch to address the vulnerability. The company also obtained written assurances that the accessed data would be deleted and would not be reused.
A company spokesperson stated that immediate steps had been taken to contain the incident and prevent further unauthorized access.
Investigation and potential impact
South Korea’s Personal Information Protection Commission initiated an investigation on 10 November 2026 to assess the circumstances of the incident and determine whether any data protection regulations had been breached.
The incident reportedly involves South Korean corporate customers using Claude for enterprise AI applications. Although the full extent of the exposure, including the number of individual records involved, remains unclear, the compromised account and usage information could potentially be exploited in targeted phishing campaigns or other social engineering attacks.
Recommended security measures
Organizations using Anthropic’s services should consider the following precautions:
Review security notifications: Monitor communications from Anthropic and other AI service providers for breach-related updates and recommended security measures.
Monitor account activity: Check corporate email, financial systems, and AI platform accounts for unusual activity or unauthorized access.
Strengthen authentication: Enable multi-factor authentication (MFA) across AI platforms and other business-critical services.
Reinforce phishing awareness: Alert employees to targeted phishing attempts that may reference account details, subscription information, or usage patterns.
Review access controls: Assess account permissions and access privileges to reduce the risk of unauthorized activity.
Member discussion