Anthropic reports Claude account data exposure at about 100 Korean companies
Anthropic has reported to South Korea's Personal Information Protection Commission (PIPC) that business account information belonging to about 100 Korean enterprise customers of Claude may have been exposed during the unauthorized access to its internal systems by the security startup Cathedral. The commission confirmed on November 9, 2026 that Anthropic filed the report on October 31, and that it is now carrying out a preliminary review before deciding whether to open a formal investigation.
The exposed information, as described by Anthropic in a notice sent to some business customers, consists of account identification numbers, organization identification numbers, names and business email addresses. In a post on X on November 8, Anthropic technical staff member Lydia Hallie said that Cathedral accessed account information such as names, emails and plan details without authorization, and that it could not reach user prompts, model outputs or payment information.
The filing is the first figure on affected customers to emerge since the incident became public. When the Cathedral episode became public on October 26, the company described the intrusion as limited to a set of sales, human resources and IT platforms run on third-party business software, and said that customer conversations, source code and model weights were never touched. The Korean filing and the customer notices now confirm that the sales-side systems held customer contact and account records, and that some of those records were viewed.
Anthropic said it blocked the affected systems on the day it confirmed the incident and worked with the software vendor to patch the vulnerability. It has not named the vendor, has not published a global count of affected accounts, and has not posted a public incident report on its own website.
··········
WHAT ANTHROPIC SAYS WAS EXPOSED IN THE CLAUDE ACCOUNT RECORDS.
The scope described in the customer notice and in the X post is narrow in type and specific in content. It covers the administrative layer of a Claude business relationship: who the customer organization is, who its contacts are, how to reach them, and which plan the organization uses. It does not cover anything that passes through the model itself.
........
Data category | Status according to Anthropic |
Account ID numbers | May have been exposed |
Organization ID numbers | May have been exposed |
Names of business contacts | May have been exposed |
Business email addresses | May have been exposed |
Plan details | Accessed, per Anthropic staff post |
Prompts sent to Claude | Not accessed |
Claude outputs | Not accessed |
Payment information | Not accessed |
........
The distinction between the two groups is the one that decides the practical risk for a customer. Prompts and outputs are where companies put source code, contracts, customer data and internal documents, and Anthropic has said from the first day that this content stayed out of reach. Account records are less sensitive in isolation, but they are the raw material of targeted phishing: an attacker who knows a contact's name, work email, organization ID and plan tier can write a convincing message that appears to come from Anthropic's billing or support teams.
Anthropic has not said whether usage or spending figures were part of the plan details. Some secondary summaries of the customer notice mention spend data, but that claim does not appear in the company statements confirmed so far, and it should be treated as unverified until Anthropic or the PIPC addresses it.
··········
TIMELINE OF THE CATHEDRAL INCIDENT AND THE KOREAN PIPC FILING.
The sequence runs across two weeks and three kinds of disclosure: Anthropic's own statements, a filing with a national regulator, and direct notices to customers.
........
Date (2026) | Event |
Before Oct 26 | Cathedral reaches Anthropic sales, HR and IT tools through third-party software |
Same day as discovery | Anthropic blocks the affected systems |
Oct 26 | Incident becomes public; Anthropic confirms limited access |
Oct 31 | Anthropic reports the data exposure to Korea's PIPC |
Around Nov 7 | Anthropic notifies some business customers |
Nov 8 | Anthropic staff post on X lists names, emails and plans |
Nov 9 | PIPC confirms the filing and its preliminary review |
........
Five days separated the public confirmation from the Korean filing, a period in which Anthropic would have had to establish which records sat in the affected systems and which jurisdictions required notification. South Korea's Personal Information Protection Act requires companies to report certain leaks of personal information to the PIPC, and the names and work email addresses of identifiable employees are personal information even when they sit in a corporate account. Anthropic has not said whether it filed similar notifications with regulators in the European Union, the United Kingdom, Japan or US states, where comparable rules exist.
Our earlier report on how Cathedral's AI agents reached Anthropic's sales, HR and IT systems covers the original disclosure, Anthropic's dispute with Cathedral over the rules of its vulnerability disclosure program, and the company's position that its monitoring flagged the activity before Cathedral submitted its findings.
··········
HOW THE PIPC REVIEW OF ANTHROPIC COULD PROCEED.
The PIPC said it is reviewing the report in advance and has not yet decided whether to open a formal investigation. The commission explained that cases involving overseas companies usually begin with formal requests for data and documents, which can take time, and that once an investigation starts it will verify the route of the leak and the scale of the damage.
That process is relevant to Korean Claude customers because the scale figure in circulation today, about 100 enterprise accounts, comes from Anthropic's own filing. A formal investigation would test that number, establish how many individual people stand behind those accounts, and determine whether Anthropic met its notification duties. Nothing in the commission's statements so far points toward a sanction, and it has given no timetable.
For the moment the regulator's position is procedural: it has received the report, it is examining it, and it will decide later whether a full inquiry is warranted.
··········
WHAT CLAUDE TEAM AND ENTERPRISE ADMINS CAN DO NOW.
Anthropic has said the incident did not reach prompts, outputs or payment data, and none of its statements confirmed so far asks customers to rotate API keys or reset credentials. The practical exposure for most organizations is therefore the misuse of contact and account details in social engineering. Administrators of Claude Team and Enterprise organizations, in Korea and elsewhere, can reduce that risk with steps that rely on controls already documented by Anthropic.
........
Step | Why it helps |
Check whether your organization received Anthropic's notice | Confirms whether your records were in scope |
Warn named contacts about Anthropic-themed phishing | Exposed names and emails enable targeted messages |
Verify billing or plan-change requests in the admin console | Plan details make fake invoices more convincing |
Turn on the Claude Console IP allowlist (beta) | Refuses API requests from addresses not on the list |
Use Admin API sign-out everywhere (beta) if an account looks compromised | Ends a member's sessions across Claude |
........
The IP allowlist, released in beta on November 5, accepts IPv4 and IPv6 addresses or CIDR ranges, up to 1,000 per organization, and refuses requests to covered services from any other address, which limits where a leaked API key can be used. The sign-out capability, also in beta, lets an Enterprise administrator sign a member out of Claude everywhere through the Admin API while keeping that person in the organization. Neither feature was built in response to the Cathedral incident, and neither addresses the exposure of contact records directly, but both narrow what an attacker could do with credentials obtained through a phishing message that borrows details from the exposed records. Our coverage of the Claude IP allowlist and sign-out-everywhere controls describes their scope and limits, and our guide to Claude Enterprise security configurations and deployment controls covers the wider set of admin settings.
Organizations that rely on Claude through Amazon Bedrock, Google Cloud Vertex AI or Microsoft Foundry hold their account relationship with those cloud providers, and nothing Anthropic has disclosed so far indicates that records held by those platforms were involved.
··········
WHAT THE CLAUDE DATA EXPOSURE MEANS FOR ANTHROPIC'S VENDOR SECURITY.
The incident did not compromise Claude as a product. Cathedral did not break the model, the inference stack or the systems that store conversations; it entered through business software that Anthropic, like most companies, buys from outside vendors to run sales, recruiting and IT administration. Anthropic's own statement that it will keep strengthening security management and monitoring of third-party software is an acknowledgment that this layer was the weak point.
The timing adds pressure, because Anthropic has filed for a public listing and is preparing to sell shares to institutional and retail investors while it competes for large enterprise contracts. Security reviews by procurement teams routinely ask vendors how they protect customer contact data held in CRM and support tools, and the Korean filing gives those teams a documented case to ask about. Anthropic has also spent recent weeks adding enterprise controls, including a security center and inference hooks for Claude Enterprise covered in our report on the new Claude Enterprise security center, and customers will now weigh those features against an incident in the company's own back office.
··········
CLAUDE ACCOUNT DATA EXPOSURE: CONFIRMED FACTS AND OPEN QUESTIONS.
Several points are established by Anthropic's statements and the PIPC's confirmation. Anthropic filed a report with the Korean regulator on October 31 covering about 100 Korean enterprise accounts. The data that may have been exposed includes account and organization ID numbers, names, business email addresses and plan details. Prompts, outputs and payment information were not accessed. Anthropic blocked the affected systems on the day it confirmed the incident and worked with the vendor to fix the flaw. The PIPC is conducting a preliminary review and has not opened a formal investigation.
Other points remain undisclosed. Anthropic has not published the number of affected customers outside Korea, the name of the third-party software, the exact dates of access, or whether usage and spending figures were part of the records viewed. It has not said which other regulators it notified. The question of whether Cathedral's activity counted as authorized research under Anthropic's disclosure program or as unauthorized access, which the two companies dispute, also bears on how regulators may classify the event.
For Claude business customers the immediate risk is concentrated in phishing that uses accurate account details, and the most useful response is to confirm whether their organization received the notice, brief the named contacts, and tighten console access with the controls Anthropic already offers.
··········
FOLLOW US FOR MORE.
·····
DATA STUDIOS
·····
datastudios.org
