Key points
- Anthropic reported a leak involving about 100 Korean Claude Enterprise accounts
- What Anthropic says the Korean account data included, and what it didn't
- Why Korea's privacy regulator hasn't opened a formal Anthropic investigation yet
Anthropic reported a data leak involving about 100 Korean corporate Claude Enterprise accounts to Korea's Personal Information Protection Commission (개인정보보호위원회) on October 31. The regulator confirmed the report on November 9, iNews24 (아이뉴스24) reported.
The information at issue includes names, email addresses, account and organization IDs, plan tiers, and usage and spending figures, according to the commission. Anthropic told some business customers that the information may have been exposed, Etoday reported. That doesn't establish that every field in every account was viewed.
Claude Enterprise is the version of Anthropic's Claude AI service that companies buy for their employees.
A US security firm reached Anthropic's systems in October
Anthropic says the incident began on October 8, when Cathedral, a US cybersecurity startup founded by former members of the Department of Government Efficiency, accessed its internal systems without authorization. Anthropic discovered the access on October 10.
Cathedral was participating in Anthropic's outside security research program, which invites researchers to find weaknesses under rules governing their work and disclosures. Anthropic says Cathedral broke those rules, including by not disclosing everything it did inside the systems. The Washington Post first reported the access on October 26, Etoday (이투데이) noted. Etoday also reported that Cathedral entered through a weakness in third-party business software.
Anthropic told iNews24 that it cut off access to the affected systems on October 10. The company said Cathedral gave written confirmation that it would delete the data it accessed and not use it again; Anthropic didn't say whether deletion had been checked. It notified Korean and overseas business customers on November 7.
Conversations and payment details weren't part of it, Anthropic says
This matters for Korean companies that use Claude at work. An Anthropic staff member said on X that Cathedral didn't reach the prompts employees typed into Claude, Claude's answers, or payment information, Etoday reported. The potentially exposed data includes customer contact and account details, plan tiers, and usage and spending figures.
That is still sensitive. If those fields can be connected to one another, the data could reveal which companies use Claude and how heavily.
Korea's regulator is still at the review stage
The commission is doing a preliminary review of Anthropic's report and hasn't opened a formal investigation. Because Anthropic is a foreign company, the commission needs to request documents and take other steps before an investigation, and that can slow the review, Etoday reported. "We will be able to confirm the specific circumstances and the scale of the damage through further investigation," a commission official told iNews24.
A formal investigation could examine how the access occurred and how many Korean accounts were affected. Anthropic said it knows it needs to do more, and that it will keep strengthening security and monitoring for the third-party software it uses.
| Date | What happened |
|---|---|
| Oct. 8 | Cathedral accesses Anthropic's internal systems |
| Oct. 10 | Anthropic finds the access and cuts it off |
| Oct. 26 | The Washington Post reports Cathedral's access |
| Oct. 31 | Anthropic reports the Korean account leak to the commission |
| Nov. 7 | Anthropic notifies Korean and overseas business customers |
| Nov. 9 | The commission confirms the report and its preliminary review |
Sources: iNews24 and Etoday, citing the commission and Anthropic.
