WorkOS reports security breach

Posted by werrett 3 days ago

Counter81Comment11OpenOriginal

It's not on their website or Trust center yet, but we received the following breach notification from WorkOS:

We are writing to notify you of a data security incident that we detected on October 30, 2026 and are continuing to investigate. We value your trust and want to keep you informed while our investigation continues.

What Happened

On October 30, 2026, at 16:39 UTC, WorkOS detected anomalous traffic to an internal business system. Our investigation identified evidence the attack was likely driven by ARTEX, an AI-assisted, autonomous penetration testing framework, from IP addresses based in Hong Kong and China.

The unauthorized actor gained access to an internal API used by our sales and marketing tools. Through this service, it was able to access data from our Salesforce and Snowflake instances. These systems hold business contact information, account and commercial information, aggregated and de-identified product usage metrics, marketing contacts, and support tickets. This includes CRM information such as names, email addresses, phone numbers, company mailing addresses, and other business information for WorkOS customers.

We have no evidence that your application data was accessed. We also have no evidence that any production WorkOS services were accessed or impacted. Our current analysis indicates this incident was localized to only CRM and customer support data.

...

Comments

Comment by grinich 3 days ago

Hi everyone - WorkOS CEO here.

WorkOS's production systems are secure. No customer platform data was accessed. This incident was isolated to internal GTM systems.

The attack involved ARTEX, an autonomous AI agent framework used to carry out offensive security operations. It's a striking example of how quickly the capabilities of attackers are evolving.

We've contained the incident, brought in independent experts to investigate, and are working through the details.

Security is something we take extremely seriously, and I believe in being transparent when things go wrong. We'll continue to share updates as we learn more.

Here’s the full post: https://workos.com/security/bulletins/october-30th-2026-data...

If you are a customer and would like to have a call with our security team, please send a note to security@workos.com

Comment by minimaltom 3 days ago

Thanks for being so transparent.

Is it understood what the initial attack vector was? How confident are you that compromise is contained to just this GTM application (and lateral movement/exposure hasnt occurred)?

Comment by grinich 2 days ago

We identified and verified the attack vector and have no indication there is other compromise.

In addition to our in-house security team, we also have hired a 3rd-party firm to do their own investigation and validate our analysis.

We hope to share more about our findings once the investigation concludes.

Comment by barrrrald 3 days ago

Thanks for the transparency

Comment by grinich 49 minutes ago

[flagged]

Comment by _pdp_ 3 days ago

> The attack involved ARTEX

Why does it matter what framework is used?

Comment by Cordiali 3 days ago

It may not be relevant from your perspective, but yours isn't the only one. Others will find this detail useful or insightful, for any number of reasons.

So, why? Because details matter.

Comment by _pdp_ 3 days ago

It is as useful as saying that attackers used Kali Linux - no details of what was actually exploited, just blaming some random tool.

Comment by NeckBeardPrince 3 days ago

They aren’t blaming a random tool, where do you see blame? For you this information may not be relevant but for many people in the cybersecurity sector it’s very relevant and helps put these frameworks into the spotlight. Sharing knowledge is not a bad thing.

Comment by majorchord 3 days ago

> We have no evidence that your application data was accessed.

Translation: We don't know how we were hacked and can't tell what anyone did or didn't look at.

In that case I would treat it as full compromise and urge everyone who might be potentially affected to change password, rotate keys, whatever you need to do to protect yourself.

Comment by viraptor 3 days ago

At any point, any company and individual is in the state of "We have no evidence that your application data was accessed." I get what you're trying to say, full verification is tricky, and there's nothing wrong with rotating credentials just in case in those situations. But you're implying way more than that and there's no reason for it.

Comment by pajamasam 3 days ago

This. If they had the data access logs enabled, they would've been able to confirm whether or not the data was accessed.

Comment by kruthikiran2007 2 days ago

[flagged]

Comment by hejiakuo 3 days ago

[dead]