Anthropic's Claude Leaks Data From 100 Domestic Corporate Accounts

Third-party software exploited by external firm; PIPC reviews leak of names, emails, contact details

Anthropic's generative AI service 'Claude' received a report that personal information from approximately 100 domestic corporate accounts was leaked. It is presumed that an external security firm exploited vulnerabilities in third-party software to gain unauthorized access to Anthropic's internal systems, exposing account information.

According to the Personal Information Protection Commission (PIPC) on the 10th, Anthropic reported on October 31 that information from approximately 100 domestic corporate accounts was leaked. The PIPC is currently conducting a preliminary review and has not yet initiated a formal investigation. The commission explained that investigations involving overseas companies may take time due to procedures such as requesting documents before formal inquiries.

The PIPC plans to confirm the specific circumstances of the leak and the scale of damage once a formal investigation begins.

Earlier, The Washington Post (WP) reported on the 26th (local time) that U.S. security startup Catedral used vulnerabilities in external business software to access Anthropic's internal systems. Anthropic reportedly informed some customers that identifiers, names, email addresses, and other business contact details linked to corporate Claude accounts might have been exposed during this incident.

Lydia Hallie, a technical researcher at Anthropic, stated on the 8th (local time) via her X (formerly Twitter) account, "Catedral accessed account information such as names, emails, and subscription plans without authorization, but did not access prompts, generated outputs, or payment details."

Anthropic claimed to have blocked affected systems and collaborated with vendors to resolve vulnerabilities on the same day it became aware of the incident. However, it added, "We recognize that more work remains and will continue to improve security and monitoring systems for third-party software."