Anthropic has reported a data exposure involving about 100 enterprise Claude accounts in South Korea, prompting a preliminary review by the country’s Personal Information Protection Commission. The artificial intelligence company submitted its report on October 31 after identifying unauthorized access to information linked to Korean corporate customers.
- Accounts involved
- About 100 enterprise accounts in South Korea
- Report submitted
- October 31
- Regulatory status
- Preliminary review before a decision on a formal investigation
The information potentially exposed included customer names and email addresses, business contact details, account and organization identifiers, subscription tiers, and metrics covering service usage and spending. Anthropic said the outside party did not gain access to customers’ prompts, Claude’s generated responses, or payment information.
The incident is believed to have occurred when Cathedral, a United States security startup, used a vulnerability in external business software to enter an Anthropic internal system. The access reportedly took place during security testing associated with an external expert program, but Anthropic told customers that the firm conducted the check without its authorization. The available evidence does not specify how long the access lasted or whether every potentially exposed data field was viewed for each affected account.
Administrative account data was exposed, not Claude conversations
Anthropic said it blocked access to the affected system on the day it discovered the activity and worked with the relevant vendor to address the vulnerability. The company’s account indicates that the exposed material was administrative and usage-related rather than the contents of customer interactions with Claude, although those records could still reveal how organizations structured and used their enterprise accounts.
The privacy commission is securing and reviewing relevant materials before deciding whether to open a formal investigation. Because Anthropic is based overseas, the preliminary process may include requests for records from the company. If an investigation begins, officials are expected to examine the confirmed number of affected accounts, the precise scope of the exposure, and whether Anthropic’s protections and notifications for users in South Korea were adequate.