2026 WorkOS — attacker reached an internal sales app; CRM contacts, account histories and sales-call notes exposed; no production data affected (company says)
Data compromised
Contact details for business staff at customers and prospects (names, emails, job titles and employers) drawn from CRM systems; customer account histories (product usage and connection or directory health); notes and excerpts from sales calls, support discussions and shared customer Slack threads; business account and relationship information. WorkOS says no data from its apps and no production services were accessed or affected. It has not disclosed how many customers or records were involved.
Technical writeup
Root cause
The attacker used automated AI tooling to probe for weaknesses and reach an internal WorkOS application used by the sales team. WorkOS discovered the unauthorized access on October 30, 2026, and disclosed it on November 3. The intrusion date has not been stated. WorkOS cut outside access to the application, reviewed access controls on internal tools and hired an independent forensics and incident response firm. Founder Michael Grinich said the tool was the ARTEX AI penetration-testing suite, citing user-agent strings in the attacker's web requests. No threat actor has been named.