WorkOS reports data breach exposing business contacts and communication summaries
According to a BleepingComputer post on Bluesky, developer platform WorkOS suffered a data breach in which a threat actor accessed business contact records and summaries of customer communications.
Written by a model from the sources below. Verify against them.
- Vendor
- WorkOS
- Product
- internal sales app
- Status
- Confirmed
- Disclosed
- Data taken
- Names, Email addresses
Summary
The item does not give the date of the intrusion or the number of affected customers.
What to do
Expect phishing that uses this breach; verify messages that mention it
For email addressesCheck WorkOS notices or status channels for official confirmation and affected-customer details
Review what customer communications were shared with WorkOS and assess their sensitivity
Rotate any WorkOS-related API keys or secrets if you have not already done so
Timeline
- Discovered
Mastodon: “WorkOS says it found unauthorized access to an internal sales application on October 30, 2026.”
4 days - Made public by BleepingComputer on Bluesky
- Confirmed by WorkOS
BleepingComputer on Bluesky: ““On October 30, 2026, we identified unauthorized access to an internal WorkOS application used by our sales team,” the company says in an incident alert .”
1 day - First seen by cve.now
What was taken
| Taken | Per the source |
|---|---|
| Names, Email addresses | BleepingComputer on Bluesky: “Data accessed by the attacker includes: Business contact details (names, email addresses, job titles, and company affiliations from the CRM systems)” |
Evidence 6
- PressBleepingComputer on Bluesky
“Developer platform WorkOS suffered a data breach after a threat actor accessed business contact records and summaries of customer communications.”
- SocialMastodon
“WorkOS confirms a # databreach after hackers reportedly used the ARTEX AI offensive security framework to automate attacks.”
- SocialBluesky
“WorkOS `detected` an AI-assisted breach on October 30, 2026, compromising business contacts and account data from Salesforce and Snowflake.”
- SocialMastodon
“WorkOS says attacker used # ARTEX # AI to breach internal sales app”
- SocialBluesky
“#WorkOS says attacker used #ARTEX #AI to breach internal sales app”
- SocialMastodon
“WorkOS says it found unauthorized access to an internal sales application on October 30, 2026.”
Corrections
None so far.
Something wrong on this page? Report an error. Every fix is listed here.
Questions about the WorkOS breach
Was WorkOS breached?
Yes. WorkOS says so: ““On October 30, 2026, we identified unauthorized access to an internal WorkOS application used by our sales team,” the company says in an incident alert .” (BleepingComputer on Bluesky).
What data was exposed?
Names, Email addresses.
What should WorkOS customers do?
Expect phishing that uses this breach; verify messages that mention it. Check WorkOS notices or status channels for official confirmation and affected-customer details. Review what customer communications were shared with WorkOS and assess their sensitivity. Rotate any WorkOS-related API keys or secrets if you have not already done so.