WorkOS internal sales tool breach exposes customer contacts and communications
WorkOS confirms unauthorized access to an internal sales tool exposing contacts, communications and usage metadata. Its CEO links the attack to ARTEX and says production platform data was not accessed; the investigation continues.
- Disclosed
- Nov 2, 2026
- Public disclosure date
- Severity
- Septic Tank Blew
- No CVE: a breach, not a bug
- Splash zone
- Organizations whose contacts, sales/support discussions or usage metadata were held in the affected WorkOS internal tool.
- WorkOS · Data breach · AI
- In the wild
- Yes
- WorkOS confirms unauthorized access; its CEO identifies ARTEX involvement.
What happened
The accessed categories include CRM identities and contact details, account histories, excerpts or summaries of sales/support/Slack discussions, and product-usage or connection/directory-health metadata. WorkOS has not published a victim count, entry-point details or a final report. The public bulletin describes an AI-assisted offensive framework; ARTEX is named separately by the CEO. This does not establish that WorkOS production authentication services were breached.
Crime-scene timeline
Oct 30, 2026
WorkOS detects unauthorized access
The affected application served internal sales teams.
Nov 2, 2026
WorkOS publishes breach bulletin
External access to the application is disabled; independent incident responders are investigating the scope.
Nov 3, 00:26 UTC
CEO names ARTEX and describes containment
The CEO says internal GTM systems were affected and no customer platform data was accessed. These are company statements during an ongoing investigation.
Who said what
We list each claim and who made it. Primary sources (the vendor, the researcher, the registry) are marked. Where reports disagree, we grade by the worst credible case.
- WorkOS security bulletinPrimaryConfirms internal sales-tool access, four data categories, containment and an ongoing independent investigation.
- WorkOS CEO statement on Hacker NewsPrimaryNames ARTEX; says production systems are secure and customer platform data was not accessed.
- Public API copy of the CEO statementPrimaryReadable copy with the original comment timestamp; the same statement, not independent corroboration.