Anthropic's Claude AI Service Suffers Data Breach Affecting Korean Corporate Accounts

Thumbnail Image

The information displayed in the AIM should not be reported as representing the official views of the OECD or of its member countries.

Anthropic's enterprise AI service, Claude, experienced a data breach after a security vulnerability in third-party software was exploited by an external security firm, Cathedral. Over 100 Korean corporate accounts had personal and organizational data exposed. The Korean Personal Information Protection Commission is reviewing the incident, which highlights ongoing AI service security concerns.[AI generated]

Why's our monitor labelling this an incident or hazard?

The event describes a realized data breach involving an AI system's user accounts, with unauthorized access to sensitive account information. The AI system 'Claude' is central to the incident, and the breach constitutes a violation of privacy and legal obligations, fitting the definition of an AI Incident. The harm is direct and material, involving personal and organizational data exposure. Although the AI-generated content was not accessed, the compromise of account information linked to the AI service is sufficient to classify this as an AI Incident rather than a hazard or complementary information.[AI generated]
AI principles
Privacy & data governanceRobustness & digital security
Industries
IT infrastructure and hostingDigital security
Affected stakeholders
Business
Harm types
Human or fundamental rights
AI system task:
Content generationInteraction support/chatbots

Articles about this incident or hazard