The facts
WorkOS says an attacker accessed an internal sales and customer-facing application on 30 October 2026. [1][2][3]
The company says the application contained customer contacts, account histories, excerpts from calls and support or Slack conversations, and product-use and connection metadata. [1][2]
WorkOS says it found no evidence that its production services or customers’ application data were accessed. [1][2][3]
In its 2 November bulletin, WorkOS said it was reviewing affected organizations and would contact customers directly; it did not provide a total number of affected organizations or records. [1][2][3]
BleepingComputer and SecurityWeek report on the incident based on WorkOS’s disclosure; neither reports independent forensic findings. [2][3]
Still unconfirmed
- The number of affected organizations, people and records has not been disclosed in the opened sources.
- WorkOS’s 2 November bulletin said its assessment was ongoing; the later reports reviewed did not establish a final scope or evidence of misuse.
Corrections & updates
Source dates clarified after reopening the primary bulletin and reports: WorkOS dated its bulletin 2 November, BleepingComputer published on 3 November and SecurityWeek on 4 November. The incident date remains 30 October; the assessment status is attributed to the company’s 2 November bulletin.
Sources
References support the numbered facts above. Source checks: 4 Nov 2026, 15:34 UTC.
The WorkOS bulletin is the primary source for its investigation and affected-data categories. BleepingComputer and SecurityWeek provide independent reporting but rely on that company disclosure. The incident’s extent remains unknown; no production access is claimed.
- October 30th, 2026 Data Security Incident
WorkOS · Primary source · 2 Nov 2026
Opened the company’s incident bulletin describing the internal application, exposed data categories and its current investigation; it says there is no evidence of production-service or customer application-data access.
- WorkOS says attacker used ARTEX AI to breach internal sales app
BleepingComputer · Reporting · 3 Nov 2026
Opened independent reporting that attributes incident details to WorkOS and notes customer notification and phishing concerns; affected counts remain undisclosed.
- AI-Linked Breaches Mount as WorkOS, Northflank, Trigger.dev Disclose Hacks
SecurityWeek · Reporting · 4 Nov 2026
Opened independent coverage of WorkOS’s disclosure; it does not present separate forensic findings for this incident.