WorkOS says attacker accessed contact records and customer communication summaries
BleepingComputer reports that developer platform WorkOS suffered a data breach in which a threat actor accessed business contact records and summaries of customer communications.
Written by a model from the sources below. Verify against them.
- Vendor
- WorkOS
- Product
- internal sales app
- Status
- Reported, not confirmed
- Disclosed
- Data taken
- Names, Email addresses
Summary
The headline attributes the intrusion to an attacker using ARTEX AI against an internal sales app, but the item's text does not confirm that detail.
What to do
Expect phishing that uses this breach; verify messages that mention it
For email addressesCheck WorkOS's official status page and customer notices for confirmed scope and affected data
Rotate WorkOS API keys and client secrets as a precaution
Review integrations and audit logs for unusual WorkOS access
Timeline
- Discovered
BleepingComputer: ““On October 30, 2026, we identified unauthorized access to an internal WorkOS application used by our sales team,” the company says in an incident alert .”
3 days - Made public by BleepingComputer
- First seen by cve.now2 days
- Record last updated
What was taken
| Taken | Per the source |
|---|---|
| Names, Email addresses | BleepingComputer: “Business contact details (names, email addresses, job titles, and company affiliations from the CRM systems)” |
Evidence 10
- SocialHacker News
“WorkOS reports security breach”
- Social
- Social
- SocialBluesky
“WorkOS says they were breached by an attacker using ARTEX, an AI-assisted cyber offensive framework”
- PressBleepingComputer
“Developer platform WorkOS suffered a data breach after a threat actor accessed business contact records and summaries of customer communications.”
+1 more: BleepingComputer on Bluesky
Show all 10 sourcesShow fewer sources
- SocialBluesky
“Developer platform WorkOS suffered a data breach after a threat actor accessed business contact records and summaries of customer communications”, BleepingComputer reports.”
- SocialMastodon
“Contact records exposed, no production services hit.”
- Social
- SocialMastodon
“WorkOS confirms a # databreach after hackers reportedly used the ARTEX AI offensive security framework to automate attacks.”
- SocialBluesky
“Attackers breached a WorkOS internal sales app, exposing customer contact info and business conversations.”
Corrections
- Removed “WorkOS says the breach happened”: its source no longer supports it.
- Removed “WorkOS says the breach happened”: its source no longer supports it.
Something wrong on this page? Report an error. Every fix is listed here.
Questions about the WorkOS breach
Was WorkOS breached?
BleepingComputer reports it. No statement from WorkOS has reached cve.now yet.
What data was exposed?
Names, Email addresses.
What should WorkOS customers do?
Expect phishing that uses this breach; verify messages that mention it. Check WorkOS's official status page and customer notices for confirmed scope and affected data. Rotate WorkOS API keys and client secrets as a precaution. Review integrations and audit logs for unusual WorkOS access.