About 100 domestic corporate accounts exposed on Oct. 31

Leaked data included customer names, email addresses, account IDs, plan ratings and usage

Anthropic vows to strengthen third-party software security

The Anthropic logo. [Reuters]
The Anthropic logo. [Reuters]

South Korea's Personal Information Protection Commission has launched a formal investigation into US AI company Anthropic.

The probe follows a leak of account information belonging to South Korean companies that use Anthropic's AI service Claude. Anthropic apologized and said it would strengthen its third-party software security monitoring.

According to industry sources, the commission completed a preliminary review Tuesday and opened a full investigation into Anthropic's reported data breach.

Anthropic notified the commission that about 100 domestic corporate accounts had been exposed on Oct. 31. The leaked data reportedly included the names, email addresses, account IDs, plan ratings and service usage records of South Korean corporate customers.

The commission said it plans to determine the full extent of the damage. Anthropic also notified affected clients of the breach. The company said it blocked the affected systems on the day it became aware of the incident and worked with its vendor to address the vulnerability.

[Reuters]
[Reuters]

Anthropic has identified US cybersecurity startup Cathedral as the party responsible for the breach, saying the firm accessed Anthropic's internal systems by exploiting a vulnerability in external business software.

Cathedral was founded by former members of the Department of Government Efficiency and is developing AI-based security technology. Anthropic said Cathedral was participating in its external security research program but appears to have violated program rules by failing to disclose all activities it carried out within Anthropic's internal systems.

Cathedral informed Anthropic in writing that it deleted the data it accessed and would not use it further.

Regarding the incident, Anthropic researcher Lydia Hallie said on social media Sunday (local time) that Cathedral "gained unauthorized access to account information including names, emails and plan details, but did not access prompts, outputs or payment information."

Anthropic said it "recognizes that further improvements are needed" and that it "will continue to strengthen the security and monitoring of third-party software."


ko@heraldcorp.com