Anthropic Claude account data exposed: expect targeted phishing

The Anthropic security incident from October now has customer names on it. Anthropic has notified some Claude business customers that their account data may have been exposed: account and organization ID numbers plus business contact details, including names and email addresses. In South Korea alone, Anthropic reported about 100 enterprise accounts to the national privacy regulator, Seoul Economic Daily reports. Your prompts are not the risk here. Your inbox is.

What actually happened

• The source is the Cathedral test. In October, The Washington Post reported that security startup Cathedral got into Anthropic's internal systems through a weakness in third-party business software. We covered that part on October 26.
• Korea's regulator has it. Anthropic reported the leak on October 31, according to the Personal Information Protection Commission. The PIPC is in a preliminary review and says a formal investigation would confirm the scale.
• What was reached, and what was not. An Anthropic technical staffer said on X on November 8 that account names, email addresses and subscription plans were accessed, but not user prompts, AI outputs or payment data. Anthropic blocked the affected systems the day it confirmed the incident and worked with the software vendor on a patch.

We left out some details that circulate in AI-news roundups, such as spend figures and claims about data deletion. We could not confirm them against a reputable source.

Why it matters for your business

Think like the attacker who has this list. They know your company pays for Claude. They know your plan tier. They have the names and work emails of the people who run the account. That is everything needed for a convincing "your Claude seats will be suspended, update billing" email, sent to the exact person who would act on it.

AI-vendor phishing is already common. We wrote about fake Anthropic emails that use browser-in-browser login pages. This list makes those attacks targeted.

What to do now:

1. Tell your Claude admins and finance team by name. Billing and seat-change emails get checked by opening the console directly, never a link.
2. Turn on SSO or passkeys for the Claude organization, and remove admins who no longer need it.
3. Watch for invoice and bank-change requests that mention AI tools. Verify on a phone number you already have.
4. Read your own notice, if you got one, and log it. Your customers may ask which vendors touched their data.

Sources: Seoul Economic Daily, The Washington Post.