# SZB-0c039a1b5c: WorkOS reports data breach exposing business contacts and communication summaries

According to a BleepingComputer post on Bluesky, developer platform WorkOS suffered a data breach in which a threat actor accessed business contact records and summaries of customer communications.

- Type: Breach
- Status: Confirmed
- Vendor: WorkOS
- Product: internal sales app
- Disclosed: 2026-11-03 21:29 UTC
- Data taken: Names, Email addresses
- Sources: 6 distinct
- First seen by cve.now: 2026-11-04 19:08 UTC · Updated: 2026-11-05 03:25 UTC

Written by a model from the sources below. Verify against them.

## Summary

The item does not give the date of the intrusion or the number of affected customers.

## What to do

- Expect phishing that uses this breach; verify messages that mention it · For email addresses
- Check WorkOS notices or status channels for official confirmation and affected-customer details
- Review what customer communications were shared with WorkOS and assess their sensitivity
- Rotate any WorkOS-related API keys or secrets if you have not already done so

## Timeline

- 2026-10-30: Discovered. Mastodon: “WorkOS says it found unauthorized access to an internal sales application on October 30, 2026.” ([source](https://infosec.exchange/@Secquill/117560683903990521))
- 2026-11-03 21:29 UTC: Made public by BleepingComputer on Bluesky
- 2026-11-03 21:29 UTC: Confirmed by WorkOS. BleepingComputer on Bluesky: ““On October 30, 2026, we identified unauthorized access to an internal WorkOS application used by our sales team,” the company says in an incident alert .” ([source](https://www.bleepingcomputer.com/news/security/workos-says-attacker-used-artex-ai-to-breach-internal-sales-app/))
- 2026-11-04 19:08 UTC: First seen by cve.now
- 2026-11-05 03:25 UTC: Record last updated

## What was taken

- Names, Email addresses: [BleepingComputer on Bluesky](https://www.bleepingcomputer.com/news/security/workos-says-attacker-used-artex-ai-to-breach-internal-sales-app/): “Business contact details (names, email addresses, job titles, and company affiliations from the CRM systems)”

## Evidence (6 sources)

- 2026-11-03 · Press · [BleepingComputer on Bluesky](https://bsky.app/profile/bleepingcomputer.com/post/3mzgrujuoxq2r): “Developer platform WorkOS suffered a data breach after a threat actor accessed business contact records and summaries of customer communications.”
- 2026-11-04 · Social · [Mastodon](https://infosec.exchange/@DevaOnBreaches/117555451432964939): “WorkOS confirms a # databreach after hackers reportedly used the ARTEX AI offensive security framework to automate attacks.”
- 2026-11-04 · Social · [Bluesky](https://bsky.app/profile/five-oclick-tech.bsky.social/post/3mzj6gbd5sj22): “WorkOS \`detected\` an AI-assisted breach on October 30, 2026, compromising business contacts and account data from Salesforce and Snowflake.”
- 2026-11-04 · Social · [Mastodon](https://mastodon.thenewoil.org/@thenewoil/117560180893734944): “WorkOS says attacker used # ARTEX # AI to breach internal sales app”
- 2026-11-04 · Social · [Bluesky](https://bsky.app/profile/thenewoil.org/post/3mzjapkmnisi2): “#WorkOS says attacker used #ARTEX #AI to breach internal sales app” (+1 more: [Bluesky](https://bsky.app/profile/hacker.at.thenote.app/post/3mzjvvdv5ws2r))
- 2026-11-04 · Social · [Mastodon](https://infosec.exchange/@Secquill/117560683903990521): “WorkOS says it found unauthorized access to an internal sales application on October 30, 2026.”

## Corrections

None so far.

Something wrong on this page? Report an error: https://github.com/sazabi/cve.now/issues/new?title=Wrong%20fact%20on%20SZB-0c039a1b5c&body=https%3A%2F%2Fcve.now%2FSZB-0c039a1b5c%0A%0AWhat%20is%20wrong%2C%20and%20the%20source%20that%20shows%20it%3A%0A

## Questions about the WorkOS breach

### Was WorkOS breached?

Yes. WorkOS says so: ““On October 30, 2026, we identified unauthorized access to an internal WorkOS application used by our sales team,” the company says in an incident alert .” (BleepingComputer on Bluesky).

Source: https://www.bleepingcomputer.com/news/security/workos-says-attacker-used-artex-ai-to-breach-internal-sales-app/

### What data was exposed?

Names, Email addresses.

### What should WorkOS customers do?

Expect phishing that uses this breach; verify messages that mention it. Check WorkOS notices or status channels for official confirmation and affected-customer details. Review what customer communications were shared with WorkOS and assess their sensitivity. Rotate any WorkOS-related API keys or secrets if you have not already done so.

## Related

- Started as early warning SZB-0c039a1b5c, first seen 2026-11-04 19:08 UTC
- Browse: [Breaches](https://cve.now/breaches.md) · [Early warnings](https://cve.now/early-warnings.md)

---

Source: cve.now, built and run by Sazabi
Page: https://cve.now/SZB-0c039a1b5c
Site guide for agents: https://cve.now/llms.txt