{"slug": "workos-reports-security-breach", "title": "WorkOS reports security breach", "summary": "WorkOS notified customers of a data security incident detected on October 30, 2026 at 16:39 UTC, when the company identified anomalous traffic to an internal business system that it says was likely driven by ARTEX, an AI-assisted autonomous penetration testing framework, from IP addresses based in Hong Kong and China. WorkOS said the unauthorized actor accessed an internal API used by its sales and marketing tools and reached data in its Salesforce and Snowflake instances, including CRM information such as names, email addresses, phone numbers, company mailing addresses and other business information for WorkOS customers. WorkOS said it has no evidence that customer application data or production WorkOS services were accessed or impacted, and that the incident was localized to CRM and customer support data.", "body_md": "It's not on their website or Trust center yet, but we received the following breach notification from WorkOS:\n\nWe are writing to notify you of a data security incident that we detected on October 30, 2026 and are continuing to investigate. We value your trust and want to keep you informed while our investigation continues.\n\nWhat Happened\n\nOn October 30, 2026, at 16:39 UTC, WorkOS detected anomalous traffic to an internal business system. Our investigation identified evidence the attack was likely driven by ARTEX, an AI-assisted, autonomous penetration testing framework, from IP addresses based in Hong Kong and China.\n\nThe unauthorized actor gained access to an internal API used by our sales and marketing tools. Through this service, it was able to access data from our Salesforce and Snowflake instances. These systems hold business contact information, account and commercial information, aggregated and de-identified product usage metrics, marketing contacts, and support tickets. This includes CRM information such as names, email addresses, phone numbers, company mailing addresses, and other business information for WorkOS customers.\n\nWe have no evidence that your application data was accessed. We also have no evidence that any production WorkOS services were accessed or impacted. Our current analysis indicates this incident was localized to only CRM and customer support data.\n\n...\n\nComments URL: [https://news.ycombinator.com/item?id=50345712](https://news.ycombinator.com/item?id=50345712)\n\nPoints: 4\n\n# Comments: 0", "url": "https://wpnews.pro/news/workos-reports-security-breach", "canonical_source": "https://news.ycombinator.com/item?id=50345712", "published_at": "2026-11-02 23:30:59+00:00", "updated_at": "2026-11-02 23:51:04.864555+00:00", "lang": "en", "topics": ["ai-safety"], "entities": ["WorkOS", "ARTEX", "Salesforce", "Snowflake", "Hong Kong", "China"], "also_reported_by": [], "alternates": {"html": "https://wpnews.pro/news/workos-reports-security-breach", "markdown": "https://wpnews.pro/news/workos-reports-security-breach.md", "text": "https://wpnews.pro/news/workos-reports-security-breach.txt", "jsonld": "https://wpnews.pro/news/workos-reports-security-breach.jsonld"}}