Anthropic recently notified customers that the cybersecurity firm Cathedral gained unauthorized access to internal business systems via third-party software. While the breach excluded sensitive data like AI prompts, model weights, and payment credentials, it compromised business contact information, subscription plans, and account metadata for approximately 100 South Korean corporate accounts. This exposure poses a significant risk for targeted phishing, as attackers could use accurate account details to impersonate legitimate support staff. Organizations should verify all account-related requests through established channels rather than relying on the sender's knowledge of internal billing or subscription metrics.
Anthropic has notified customers about unauthorized access to internal business systems by cybersecurity startup Cathedral. A customer notice made public on November 7, 2026, described potentially exposed business contact and account information. An Anthropic employee subsequently identified Cathedral and said the accessed data included names, email addresses and plan details, but excluded prompts, outputs and payment information.
South Korea’s Personal Information Protection Commission is also reviewing an Anthropic filing concerning approximately 100 Korean corporate accounts, according to MoneyToday’s November 9 report. The regulator’s work remains a preliminary review. It has not opened a formal investigation.
The key distinction is between Anthropic’s business records and the content customers send to Claude. The disclosed account metadata could make targeted phishing more convincing. It is not evidence that attackers obtained customer conversations, passwords or payment credentials.
What Anthropic Told Customers
Jamieson O’Reilly posted screenshots of the customer notice on November 7 and criticized its explanation of the incident. The notice described a third-party cybersecurity research company accessing internal systems without Anthropic’s authorization.
Anthropic employee Lydia Hallie replied publicly, connecting the notice to Cathedral’s previously reported access through third-party software. She said Cathedral reached business contact information and account details such as names, email addresses and subscription plans, “but not prompts, outputs or payment details.”
The notice’s categories matter because “account data” can describe several very different things:
Data category
What the published disclosures say
Names and email addresses
Included in the business contact information Cathedral accessed, according to Hallie
Account and organization identifiers
Listed among potentially affected enterprise account information
Plan tier, usage and spend metrics
Listed among potentially affected account metadata
Prompts, conversations and outputs
Excluded from the accessed information, according to Anthropic
Passwords, payment-card and bank-account information
Not accessed, according to Anthropic’s statements to the press
The customer notice and Hallie’s response are available in the published thread. Anthropic’s broader statements about source code and model weights were also covered in Decrypt’s October 26 report.
Spend metrics and payment credentials deserve particular care here. A record showing how much an organization spends is commercially sensitive, but it is a different category from a card number or bank-account detail. Likewise, usage metrics can reveal the scale of an account without containing the text of its conversations.
That is the most useful distinction in the disclosure, in my view: customers need to understand both the information exposed and the systems it could help someone impersonate. Calling everything “billing data” would obscure the difference between account intelligence and information that could directly authorize a payment.
Anthropic’s notice also acknowledged that it “cannot confirm whether any particular person’s information was viewed.” The listed categories therefore describe the potential exposure, not a verified record of every field viewed for every customer. The exclusions remain Anthropic’s account of the incident; the supplied reporting does not provide an independent forensic audit.
Cathedral Entered Through Third-Party Business Software
The incident was publicly reported before the customer notice appeared online. The Washington Post’s October 26 article described Cathedral’s access to Anthropic’s internal systems, drawing on a draft Cathedral report.
Anthropic confirmed that Cathedral reached a limited set of sales, human-resources and IT systems through third-party business software, according to Decrypt’s account of the reporting. These are tools used to run a company: managing customers, employees and internal operations.
The reported entry point was not a vulnerability in Claude’s conversation interface or API. The route ran through external software connected to Anthropic’s business operations.
That distinction explains how customer account information could be exposed without customer prompts being reached. A company’s sales and administrative systems can hold customer names, subscription information and organization identifiers separately from the infrastructure that stores conversations or serves models. Access to one environment does not automatically imply access to the others.
Hallie said Anthropic contained the affected systems on the day it learned of the access and worked with vendors to close the vulnerabilities. Decrypt reported that Anthropic disabled affected software until vendors confirmed fixes. The vendors were not named in that report.
The Timeline and Authorization Are Contested
Cathedral’s claim that its AI agents found routes into Anthropic’s systems in less than 12 hours appeared prominently in early coverage. Anthropic’s Logan Graham disputed that framing in a public response reproduced in the customer thread.
Graham said Anthropic observed several days of attempts before Cathedral exploited two third-party vulnerabilities. He said Cathedral reported one vulnerability, while Anthropic independently identified the other and cut off access.
The two accounts should not be collapsed into an independently verified “12-hour hack.” They describe a disputed timeline, and the supplied evidence does not resolve the timing difference.
Authorization also matters. Graham said the activity went beyond an ordinary bug-bounty finding and fell outside Anthropic’s safe-harbor policy. Decrypt reported that Cathedral said it kept data access to a minimum, while Anthropic said the company had not disclosed all its activity. Describing Cathedral as a security research firm does not, by itself, mean Anthropic authorized the access at issue.
The practical security lesson is specific: an AI company’s exposure includes the ordinary business software surrounding its models. Protecting model weights and conversation infrastructure is important, but customer privacy also depends on sales, support and administrative tools.
South Korea’s Review Covers About 100 Corporate Accounts
Anthropic notified South Korea’s Personal Information Protection Commission on October 31 about information associated with approximately 100 domestic corporate accounts, MoneyToday reported on November 9, citing the commission.
The report explicitly places the matter at the preliminary-review stage. It says the commission has not launched a formal investigation and explains that cases involving overseas companies often involve document requests before an investigation begins.
Three boundaries are important when reading that figure:
It counts corporate accounts. It is not a published count of individual people whose information was viewed.
It concerns South Korea. Approximately 100 accounts is not the worldwide scope of the incident; no global affected-account count is available in the supplied reporting.
It describes a filing under review. The report does not announce a regulatory finding or a formal investigation.
MoneyToday’s English page is labeled as an automated translation. Its central procedural distinction is nevertheless explicit: preliminary review, with no formal investigation yet.
The filing adds a concrete jurisdiction-specific measure of scope. It does not settle which fields were accessed for each account, establish how many people were affected globally or determine Anthropic’s legal responsibility.
Why Account Metadata Can Still Support Targeted Phishing
Names, email addresses and subscription details can give a fraudulent message the appearance of an existing business relationship. An organization identifier or plausible spending figure could make an impersonated account-support message harder to dismiss.
A hypothetical attacker could reference a company’s plan and claim that an administrator must resolve a billing issue. Another could pose as an internal procurement contact and use accurate account details to support a fake request. These are practical implications of the disclosed data categories, not evidence that either attack has occurred in this case.
The important mechanism is credibility. A recipient may assume a message is genuine because it contains information that feels private. Once that information has potentially been exposed, familiarity with the account is a weaker authentication signal.
Anthropic told the press it had no evidence that anyone other than Cathedral exploited the flaws, according to Decrypt. That limits what can be said about subsequent misuse. It does not make the metadata irrelevant to a customer’s security precautions.
Enterprise customers can take several proportionate steps:
Review the actual Anthropic notice. Route it to the people responsible for security, privacy and the organization’s Anthropic account.
Open account pages independently. Use a known bookmark or type the service address instead of following an unexpected billing or security link.
Verify unusual requests through an established channel. An accurate name, plan or account identifier should not be sufficient proof that a sender is legitimate.
Brief help-desk, finance and procurement staff. Those teams may receive account-related requests that look credible because they contain real business details.
Keep the response tied to the disclosed data. The published notice is not evidence that passwords or payment credentials were exposed.
I would prioritize verification procedures over an indiscriminate credential-reset campaign based solely on this disclosure. The documented risk is that someone could make a more convincing account-related approach. Any reset request should itself be authenticated, especially if it arrives through an unsolicited email.
The Customer Pushback Centers on Assurance
O’Reilly’s criticism focused on the notice’s reasoning and its reliance on Cathedral’s written assurance that it had deleted the accessed data and would not use it. He also challenged Anthropic’s reassurance about risk while the company could not confirm whose information had actually been viewed.
That is one recipient’s documented response, not evidence of a wider customer consensus.
The distinction behind the criticism is worth preserving. A written deletion assurance records what the recipient of the data has committed to do. It is not the same thing as an independently demonstrated account of every copy or access. The supplied evidence does not show that Cathedral retained or misused the information.
Hallie acknowledged that leaving Cathedral unnamed in the notice made it harder for customers to connect the email to earlier reporting. She also said Anthropic was continuing to improve security and monitoring for the third-party software it uses.
Customers now have a clearer explanation of the access path and the data categories. The immediate task is to review the notice and strengthen verification around account-related messages, while South Korea’s regulator assesses the filing.
Frequently Asked Questions
3 questions
1
Were Claude Prompts or Responses Exposed?
Anthropic says Cathedral did not access customer prompts, conversations or outputs. Its public response describes the accessed customer information as business contact and account metadata.
2
Does the 100-Account Figure Cover All Customers?
No. MoneyToday’s report concerns approximately 100 South Korean corporate accounts. The supplied reporting provides no worldwide affected-account count.
3
Has South Korea Opened a Formal Investigation?
No. According to MoneyToday’s November 9 report, the Personal Information Protection Commission is conducting a preliminary review of Anthropic’s filing.
