Anthropic's Claude Enterprise Data Leak Exposed

Data Leak Reported

Anthropic reported to South Korea's Personal Information Protection Commission that personal data tied to about 100 South Korean corporate accounts was leaked in connection with its enterprise AI service Claude Enterprise.

Breach Originated From Cathedral

The breach is believed to have stemmed from US security startup Cathedral exploiting a vulnerability in third-party business software to reach Anthropic's internal systems.

Potentially Exposed Data

Potentially exposed data includes names, email addresses and other business contact details, account and organization identifiers, subscription tiers, and usage and spending records.

Data Not Exposed

Prompts, AI responses and payment information were not affected by the leak.

Regulator Reviewing Case

South Korea's Personal Information Protection Commission is reviewing the filing and will decide whether to open a formal investigation.

Company Response

Lydia Hallie, a technical researcher at Anthropic, said on X on November 8 that there was unauthorized access to information such as account names, email addresses and subscription plans.

“there was unauthorized access to information such as account names, email addresses and subscription plans, but users' prompts, ai responses and payment information were not accessed”

System Block and Fix

The company blocked access to the affected systems on the day it confirmed the incident and worked with the software vendor to fix the vulnerability.