Antropic ‘Claude’ personal information leak reported… Over 100 domestic corporate accounts

An external security company accesses the internal system without permission... Potential exposure of personal information

Personal Information Committee preliminary review in progress... A decision is scheduled to be made on whether to launch a formal investigation.

(Seoul = Yonhap News) Reporters Kwon Ha-yeong and Cha Min-ji = Reports of personal information leaks have been received in relation to about 100 accounts of domestic companies that use the U.S. Antropic's generative artificial intelligence (AI) service 'Claude'.

There was a possibility that account information may have been exposed when an external security company used a vulnerability in third-party software to gain unauthorized access to Antropic's internal system.

According to the Personal Information Protection Commission on the 9th, Antropic reported on the 31st of last month that information from about 100 domestic corporate accounts had been leaked to the outside world.

The Personal Information Commission is currently in the preliminary review stage of this matter and has not yet launched a formal investigation.

The explanation is that, unlike domestic businesses, foreign companies sometimes go through a data request process before starting an investigation, so the review before starting may take time.

The Personal Information Commission said, “Once we begin the formal investigation, we plan to confirm the specific extent of damage through additional investigation.”

This leak is believed to have occurred when an external security company accessed Antropic's internal system.

Previously, the Washington Post (WP) reported on the 26th of last month (local time) that US security startup Cathedral accessed Antropic's internal system by exploiting a vulnerability in external business software.

It is known that Antropic sent notices to some of its customers stating that business contact information, including account and organization identification numbers, names, and email addresses of corporate Cloud accounts, may have been exposed as a result.

Regarding Cathedral's access to the system, Lydia Harley, an Antropic technology researcher, posted on her

They say they blocked the affected system on the day they became aware of the issue and worked with the supplier to resolve the vulnerability.

However, he added, "We are aware that more work remains to be done," and added, "We will continue to improve our third-party software security and monitoring system."