Anthropic Faces South Korean Privacy Investigation Into a Reported Data Exposure Involving 112 Claude Accounts

South Korea's Personal Information Protection Commission (PIPC) opened a formal investigation into Anthropic on 10 November over exposed account data belonging to domestic corporate customers of its Claude generative AI service.

A commission official said 112 domestic corporate accounts have been reported as leaked. Anthropic notified the regulator on 31 October, and a preliminary review preceded the formal step.

Regulator Tests Scale and Safeguards in the Exposure

The commission will examine the circumstances of the leak, its scale and whether Anthropic met its obligation to put safety measures in place to protect personal information. It will also look into possible leakage from an external security company, as part of its check for violations of the Personal Information Protection Act.

The figure counts accounts, not people. Korean media reports note that it does not indicate how many companies or individuals were affected.

Anthropic Rules Out Conversations but Not Individual Exposure

A notice Anthropic emailed to enterprise customers lists the exposed fields: account and organisation IDs, plan tier, and usage and spend metrics. Korean reports add names and email addresses. Anthropic says prompts, generated outputs, passwords and payment details were not accessed.

The company says the security firm certified in writing that it has deleted the data and will not use it. It also says it has found no evidence that the data was altered, deleted or misused. The same notice states that the company 'cannot confirm whether any particular person's information was viewed'.

Customers Hold a Notice but No Individual Answers

The notice describes the firm as conducting a security testing exercise on its own initiative, and does not name it. Press reports have linked the incident to Cathedral, a US startup.

The Washington Post reported on 26 October that Cathedral reached a limited set of Anthropic's sales, HR and IT systems in under 12 hours, through third-party administrative and sales software rather than Claude itself. Anthropic said that the startup did not fully follow its programme for outside researchers because it did not disclose all of its activity.

Cathedral has said its testing aimed to expose security vulnerabilities at a major US AI company, while Anthropic characterises the access as unauthorised. Anthropic has not publicly stated whether the notices concern Cathedral.

The company says it blocked access on the day it learnt of it, worked with the software vendor to fix the vulnerability and opened its own investigation. The notice also says the incident was reported 'to the relevant Korean authorities' but does not explain why Korea was specifically notified.

The notice gives no figure for the organisations or people affected. It leaves each customer to decide whether to warn its own staff and directs questions to a privacy email address. Anthropic says it is also improving its security checks and monitoring of external software.

Security researcher Jamieson O'Reilly posted the notice on X on 7 November in a message addressed to chief executive Dario Amodei and other staff. He questioned how Anthropic could say it cannot confirm whose data was viewed while also saying it has no reason to believe recipients face heightened risk.

The notice does not answer the question. Until the commission reports, customers weighing disclosure to their own staff have that email address and little else.