Anthropic data breach

What happened

Anthropic, the US developer of the Claude AI assistant, reported to South Korea's Personal Information Protection Commission (PIPC) on October 31, 2026 that information tied to about 100 Korean enterprise Claude accounts had been exposed. The PIPC disclosed the report on November 9 and said it is reviewing the case before deciding whether to open a formal investigation, through which it would confirm the scale of the damage. The exposure is believed to stem from an outside security firm's access to Anthropic's internal systems through a flaw in third-party business software; the Washington Post reported on October 26 that the security startup Cathedral had gained such access. According to Korean reports, Anthropic told some business customers that account and organization ID numbers and business contact details such as names and email addresses may have been exposed. Anthropic has said the access reached a limited set of sales, HR and IT systems, that customer conversations with Claude, Claude's responses, source code and model weights were not accessed, and that it shut off the access the same day it was flagged.

What should I do?

1. Be wary of emails that appear to come from Anthropic or Claude about your account, billing or subscription plan, and sign in only by typing the address yourself.
2. Never share passwords, API keys or verification codes in reply to an email, chat message or phone call.
3. If you administer a Claude business account, review the notice Anthropic sent your organization and check member lists and admin settings for anything unexpected.
4. Warn colleagues listed on the account about targeted phishing that uses their name and work email.

More data breaches in the United States →

Check the other services you use →