WorkOS disclosed on November 2 that an attacker accessed an internal application used by its sales team on October 30, exposing business contact details, account histories and excerpts from sales calls, support discussions and customer Slack conversations.

In its security bulletin, the identity-services company said it is still reviewing affected records to determine the impact on individual organizations.

WorkOS said the intrusion involved an AI-assisted offensive security framework used to automate reconnaissance and exploitation attempts. CEO Michael Grinich identified the framework as ARTEX in a Hacker News comment. ARTEX was also reported in attacks on South Korean banks and in a separate investigation into a suspected operator.

The company said there is no evidence that customer application data or production WorkOS services were accessed. It disabled external access to the affected application, began reviewing access controls across internal tools and retained an independent digital forensics and incident response firm. WorkOS said it will contact affected customers directly as the investigation continues.


Buy ExpressVPN with PayPal or Credit Card
Advertisement
READ
TeamViewer Patches Three High-Severity Flaws, Including Two RCE Bugs