South Korea's privacy regulator reviews Anthropic report that about 100 Korean business accounts were exposed
The PIPC says Anthropic reported the leak on 31 October and it has begun a preliminary review, not yet a formal investigation; Anthropic says prompts, outputs and payment data were not accessed.
Why it matters
This is the first regulator known to be looking at the exposure that followed the Cathedral incident, in which, as The Washington Post reported on 26 October, a security start-up reached Anthropic's internal systems through a flaw in third-party business software. Anthropic's notice said business contact details, names, emails and account and organisation IDs may have been exposed. The PIPC says it may request documents first because Anthropic is a foreign company. Watch whether it opens a formal investigation and whether regulators elsewhere follow.
Key facts
- About 100 Korean business Claude accounts affected
- Anthropic reported to the PIPC on 31 October
- PIPC is in a preliminary review, no formal investigation yet
- Washington Post reported Cathedral's access on 26 October
- Possibly exposed: names, emails, account and organisation IDs
- Anthropic: prompts, outputs and payment data not accessed