Anthropic data breach: what Cathedral reached, what may have been seen, and Korea's probe

The Morse teamPublished November 11, 202610 min read

The Anthropic data breach that came to light in October 2026 exposed business contact and account records for some Claude customers, including staff accounts at about 100 Korean companies, eToday reports, citing Anthropic's report to Korea's regulator. Anthropic says the breach didn't reach anyone's conversations with Claude. Anthropic told the Washington Post that a security startup called Cathedral got into some of Anthropic's sales, HR, and IT systems through flaws in third-party business software, and Anthropic's notice says names, email addresses, account and organization IDs, plan tiers, and usage and spend figures may have been viewed. South Korea's Personal Information Protection Commission (PIPC) opened a formal investigation on November 10, 2026, Aju News reports, after Anthropic reported the incident to it on October 31, NoCut News reports.

On November 11, 2026, we read the notice Anthropic emailed customers, from screenshots a recipient posted on X, since we found no copy on Anthropic's site. We also read the X post in which Anthropic's head of the Frontier Red Team answered the first report, Anthropic's privacy policy, data processing addendum, and responsible disclosure policy, and the PIPC's own pages in Korean and English. The PIPC hasn't issued a press release about Anthropic, and Cathedral hasn't published its report, so some facts below come only from reporting, and we name the outlet each time. What Cathedral says it reached is its own claim and hasn't been independently checked. Anthropic's notice says plainly what it can't confirm.

What happened in the Anthropic data breach?

Cathedral, a months-old company founded by former members of the U.S. DOGE Service, got in "by exploiting vulnerabilities in business software used by the AI firm and many other companies for administrative and sales tasks," the Washington Post reported on October 26, 2026, from a draft Cathedral report. The Post says Cathedral probed Anthropic under Anthropic's program for outside security researchers. Anthropic told the Post that Cathedral "had not fully followed the rules of its bug bounty program." Its notice describes the firm as testing "on its own initiative and without our authorisation," and its red team lead called the work "out of scope" (both below). Neither side has named the software.

Anthropic told the Post that the researchers reached "a limited set" of its sales, human resources, and IT systems. Its statement, as the Post describes it, said those systems held business contact details for some customers and partners and some basic user account records, and that the researchers could not reach customers' messages to Claude, the replies, the code, or the model weights. "Our monitoring flagged some of Cathedral's activity before they reported it to us, and we shut off their access the same day," the statement said. Anthropic also said it switched off the business software involved until the vendors confirmed the holes were fixed, and that it had "no evidence that anyone exploited these vulnerabilities outside of Cathedral."

What does Cathedral say it reached?

More than Anthropic does, and this part is an allegation. According to the Post, Cathedral's draft report says that after running AI agents for less than 12 hours, its researchers found paths to meeting transcripts, salary and job-offer details, and Slack messages about Anthropic's advanced models. The report says "data accesses were kept to the absolute minimum in accordance with security research best practices." A Cathedral spokeswoman declined to comment to the Post, and as of November 11, 2026, Cathedral's website carries no statement.

Logan Graham, who leads Anthropic's Frontier Red Team, disputed the timing on X the day the story ran: "it didn't take 12 hours. we saw several days of attempts." He wrote that Cathedral "exploited two 3rd party vulnerabilities, one they reported and the other we identified independently (and cut off access)," and that "nothing came close to our most sensitive systems, like model weights or Claude conversations" (Logan Graham on X). Because the work "involved exploiting 3rd parties and accessing data," he called it "out of scope of our safe harbor policy," while saying Anthropic was grateful the issues were found.

Anthropic's Responsible Disclosure Policy, last updated February 14, 2025, explains the objection. It "does not cover any information systems, websites, or applications that are owned, operated, or controlled by any third party, including any service provider," and asks researchers to avoid "accessing, acquiring, or using data" and not to "exfiltrate, download, or otherwise retain any data." Anthropic also told the Post that Cathedral hadn't disclosed all of its activity and had overstated the "implied national security implications."

What Claude data was exposed, type by type

Anthropic's notice and its public statements, read on November 11, 2026, set against Cathedral's claims and Korean reporting. "May have been" follows the notice, which says Anthropic can't tell whose records were opened.

The email, titled "Notice Regarding Your Organization's Account Information," came from no-reply@email.claude.com. It says "we cannot confirm whether any particular person's information was viewed" and that Anthropic is writing "out of an abundance of caution should you wish to notify individuals in your organization." It adds that "the cybersecurity firm has certified in writing that it has deleted the accessed data and will not use it," and that Anthropic has "found no evidence that the accessed data was altered, deleted, or otherwise misused." Security researcher Jamieson O'Reilly, who posted the screenshots on November 7, quotes it describing the firm as "conducting a security testing exercise on its own initiative and without our authorisation."

The notice was written for more people than enterprise customers. It opens "Thank you for your interest in Anthropic," lists contact details for every recipient, and adds account fields only "if you have an enterprise Claude account," so it appears to cover sales contacts as well as customers.

A timeline of the Anthropic data breach

Dates from Anthropic's own posts and from reporting, each marked with its source.

• October 8, 2026. A third-party security research company reaches data in some internal systems, Byline Network reports, citing the Korean notice. Graham's post says Anthropic "saw several days of attempts," and gives no dates.
• October 10. Anthropic learns of the access, per the same report.
• October, before the 26th. Cathedral discloses its findings to Anthropic through its researcher program and tells the software vendors, according to the Post's account of Cathedral's report.
• October 26. The Washington Post publishes. Graham replies on X at 22:37 UTC.
• October 31. Anthropic reports the incident to the PIPC, Korean outlets including NoCut News report.
• November 7. The notice goes out by email. O'Reilly posts it on X at 10:50 UTC.
• November 8. An Anthropic employee writes on X that Cathedral reached "names, emails and pricing plans, but could not access prompts, outputs or payment information," as NoCut News quotes it.
• November 9. Korean outlets report the case. NoCut News reports the PIPC is still in preliminary review.
• November 10. The PIPC opens a formal investigation, Aju News reports. News1 reports 112 accounts, and eToday reports 112 staff accounts at about 100 companies.
• November 11. We find no item on Anthropic in the PIPC's Korean press releases or its English notices.

Why is South Korea investigating Anthropic?

Because Anthropic reported the incident to it, Korean outlets including NoCut News report. In its formal investigation, the PIPC will check whether personal data actually leaked, how much damage was done, and how the incident happened, Aju News reports, and News1 reports that the commission will look at possible leaks through the outside security firm and any violations of law. ZDNet Korea expects the actual scope of the exposure and Anthropic's data protection measures to be the main issues. The counts differ by outlet. NoCut News reported about 100 corporate accounts, while eToday reports that Anthropic's filing covered accounts at about 100 companies and that 112 staff accounts reportedly leaked.

How long the investigation takes is an open question. Under a plan the PIPC announced in October 2026, "the PIPC will complete investigations into general data incidents within 6 months and simple data incidents within 4 months," in principle (PIPC, official English translation). Before it opened the case, the commission said, according to NoCut News, that unlike domestic operators, foreign companies "often go through a document request process before an investigation starts, so it takes time." Anthropic's privacy policy names its representative in Korea for data protection matters as Anthropic Korea, Limited, with the law firm Kim & Chang assisting, at anthropic_privacy@kimchang.com (Anthropic).

Was Claude hacked?

Not Claude itself, on everything Anthropic has said. The way in ran through other companies' business software to Anthropic's sales, HR, and IT systems, and Anthropic says no conversations were reached. Other incidents turn up under the same search. In March 2026, Fortune reported that Anthropic's website content system had left about 3,000 unpublished files, including details of an unreleased model, open to anyone who requested them. Anthropic blamed "human error in the CMS configuration" and said it "did not involve our core infrastructure, AI systems, customer data, or security architecture." Claude models breaking into outside systems during Anthropic's own July 2026 tests are covered in what Anthropic's IPO filing says. For other companies' records, see the ChatGPT data breach history and AI chatbot data breaches from 2023 to 2026.

What should Claude Team and Enterprise admins do?

Decide whether to tell your staff, since the notice leaves that to you. Then plan for phishing. The fields that may have been exposed (a person's name, work email, plan tier, and spend) are what a convincing fake renewal notice or invoice would use. Byline Network reports the notice warns against answering anyone posing as Anthropic who asks for passwords, login codes, or payment details.

Check your contract, too. Anthropic's Data Processing Addendum has its own section on security breaches, and it defines a Security Breach as unauthorized access to "Customer Personal Data," meaning "personal data submitted through the Services." Account and billing records may fall under other terms, so ask your account team which ones cover this incident.

How Morse keeps your chats out of a company's back office

This breach reached account records in a company's back-office systems. A breach at any AI company could land closer to the chats it stores. At Anthropic, that includes every Claude chat you keep, saved on its servers under an account with your name, your email, and the phone number it collects at sign-up. Morse is built so there's no store of your chats on our servers for a pathway like this to reach.

Our servers don't keep messages or log message content. Your Morse account holds your sign-in details, plan, balance, and a usage ledger with no content. Your chat history is stored in your browser, encrypted, and it locks when you sign out. Opening it takes two keys, one that never leaves your device and one our server hands over at sign-in.

Each chat gets a privacy mode:

• Anonymous, to use Claude without your name in Anthropic's records. Before a message reaches Anthropic, our proxy takes off your account, email, and IP address, and the request arrives under Morse's own account. Anthropic sees the question without knowing it's you, and may keep it for a limited time to check for abuse, under its own policy, so leave your name and employer out of the text. Pro includes Claude Sonnet 5.5, at $19 a month.
• Private, so the host that runs the model agrees to keep nothing. New chats start here. DeepSeek, Kimi, GLM, and Grok run under zero data retention, because Morse has zero data retention agreements with its inference, search, and other providers. Where a provider confirms zero retention on each reply, Morse checks for it and refuses a reply without it.
• E2EE, for anything no one else should read. Your browser checks the secure enclave's cryptographic proof before anything leaves your device, then encrypts the message so only that enclave can open it, and our servers pass along text they can't read. Third-party providers run the enclaves, not Morse, and the protection rests on the enclave hardware and attestation working as designed. E2EE comes with Pro.

Morse doesn't train AI on your content, sell your data, or show ads, and it runs no advertising trackers or third-party analytics. You sign in with an emailed code, a password, or Google. Since your history is stored only in your browser, clearing it or losing the device deletes your chats, and Morse can't recover them, so keep a copy of anything you need. Our privacy policy has the details, and how to use Claude anonymously compares the other routes.

Send a first message from the Morse home page without an account, or start free and keep your history in your own browser.