Anthropic’s Claude also caught up in breach...Data linked to around 100 South Korean companies exposed

[Financial News] Information linked to around 100 South Korean corporate accounts was found to have been exposed externally at U.S.-based Anthropic, which operates the generative AI service Claude. 
According to industry sources on the 9th, Anthropic recently reported to the Personal Information Protection Commission (PIPC) a personal information breach involving around 100 Claude accounts for South Korean businesses. The PIPC is examining the report to determine the specific circumstances of the breach and the extent of the damage.
The incident is believed to have occurred when a third-party security firm exploited a vulnerability in business software used by Anthropic to access its internal systems. The firm was reportedly the U.S. cybersecurity company Cathedral.
The information potentially exposed includes business contact details, such as the names and email addresses of company representatives, as well as information related to corporate accounts. Corporate Claude accounts may include account and organization ID numbers, subscription plans, service usage, and spending-related information.
Anthropic says that conversations exchanged through Claude, account passwords, payment card details, and bank account information were not among the information exposed in this incident. The specific extent of the damage, including what information was actually viewed externally, still needs to be confirmed.
Anthropic said it had blocked the external firm’s access to its systems and taken steps to address the identified vulnerability. It reportedly also obtained written confirmation from the security firm that it would delete the information it had accessed and not use it.
The PIPC is expected to review the report before deciding whether to launch a formal investigation. The investigation is expected to focus on the external firm’s access route, the extent of the information actually viewed, and whether Anthropic’s personal information protection measures were adequate.
[email protected] Yoon Hong-jip Reporter