GoKawiilWorkOS discloses breach of sales CRM and support data
WorkOS notified customers of a data security incident first detected on October 30, 2026, after anomalous traffic hit an internal business system. The company says an unauthorized actor accessed an internal sales and marketing API, which in turn exposed data from its Salesforce and Snowflake instances, including customer names, emails, phone numbers and business contact details. WorkOS states it found no evidence that application data or production services were affected, and believes the breach was limited to CRM and support data.
GoKawiil's interpretation of the reporting above, not reported fact.
WorkOS attributes the intrusion to ARTEX, described as an AI-assisted autonomous penetration testing framework operating from Hong Kong and China-based IP addresses, which if accurate could signal a shift toward automated attack tooling targeting SaaS vendors' back-office systems rather than core infrastructure. Because WorkOS provides identity and access infrastructure to many other companies, exposure of its CRM contact data could be used for follow-on phishing or social engineering against its customers. The investigation is ongoing, so the scope could still change.
- WorkOS detected the breach on October 30, 2026, affecting an internal sales and marketing API.
- Exposed data includes CRM business contacts, account details, marketing contacts and support tickets from Salesforce and Snowflake.
- WorkOS says there is no evidence that customer application data or production services were accessed.
Source: news.ycombinator.com, 2026-11-02
Published there as: “WorkOS reports security breach”
Read the original report → The summary and analysis above are GoKawiil's own, written from reporting by the source above. Facts and quotes belong to the original publisher.