WorkOS Breach Exposes Sales and Support Data Through Internal Application

WorkOS detected unauthorized access to an internal sales and marketing application on October 30 and disclosed the incident on November 2. The attacker accessed data from its Salesforce and Snowflake instances, potentially exposing customer business contact details, account histories, commercial information, business communications, de-identified usage metrics, and support tickets. The exact records accessed remain under investigation. WorkOS said it found no evidence that customer application data or production services were accessed or impacted.

WorkOS disabled external access to the affected application and engaged an independent incident response firm. The company identified signs of an AI-assisted offensive security framework automating reconnaissance and exploitation attempts. Reporting linked the activity to ARTEX, although a separate account noted that WorkOS's public bulletin did not explicitly name that framework; reported traffic originated from IP addresses in Hong Kong and China, which does not establish attacker attribution. Customers should verify unexpected requests through trusted channels, as exposed contact information and conversation details could enable convincing, context-aware phishing.