WorkOS confirms data breach exposing customer Slack conversations

WorkOS detected unauthorized access to an internal sales app on October 30, 2026, with no evidence of production service impact.

WorkOS confirmed unauthorized access to an internal sales application, exposing customer contact information and records of business conversations. The company detected the incident on October 30, 2026, and published a security bulletin on November 2. Its investigation identified an AI-assisted offensive security framework used to automate reconnaissance and exploitation attempts. The affected application provided access to names, email addresses, phone numbers, job titles, and company affiliations stored in customer relationship management systems. It also contained customer account histories and sales relationship information. Customer communications included summaries and excerpts from sales calls, support discussions, and customer Slack conversations. Operational metadata covered customers’ use of WorkOS products. WorkOS disabled external access to the affected application, began reviewing access controls across internal tools, and retained an independent digital forensics and incident response firm.

Unconfirmed: The public bulletin does not explicitly name ARTEX; only links to related research are provided.