According to South Korean media reports, Anthropic, the operator of the generative AI service Claude, recently notified the Korean Personal Information Protection Commission of a data breach involving information related to approximately 100 corporate accounts of Claude in South Korea. The Korean Personal Information Protection Commission is currently verifying the specifics of the breach and the extent of the impact based on the report.
According to relevant information, the incident originated from an external security firm exploiting a vulnerability in the office software used by Anthropic to gain access to its internal systems. The firm involved is reportedly the U.S. security company Cathedral. Potentially exposed information includes the names, email addresses, and other work contact details of corporate executives, as well as data related to corporate accounts. Information related to the corporate accounts of Claude may include account identification numbers, organization identification numbers, subscription plans, service usage, and expenditure details.
Anthropic Has Taken Measures to Prevent Data Breaches
However, Anthropic stated that the conversation content exchanged by users through Claude, account passwords, payment card information, and bank account information were not part of this breach. It remains to be confirmed what specific information was actually accessed by external parties. Anthropic claims it has blocked the external firm from continuing to access its systems and has taken corrective measures for the identified vulnerabilities. The involved security firm has also committed in writing to delete the information it previously accessed and not to use it.
The Korean Personal Information Protection Commission will decide whether to initiate a formal investigation after reviewing the reported materials. Subsequent investigations may focus on the specific pathways through which the external firm accessed the system, the actual scope of the information reviewed, and whether the personal information protection measures taken by Anthropic were appropriate.