Only CRM and customer support data was involved, including contact details, account relationships, and summaries of sales and support calls and Slack. There is no evidence that application data was accessed. The number of people and the entry point were not disclosed.
Confirmed victims
- WorkOS
Attribution
- ARTEX basis
- The bulletin text says only AI-assisted offensive security framework. The founder named ARTEX based on the User-Agent of web requests (artex-enrich/1.0, norma/0.4). This is not forensic evidence of the tool itself. BleepingComputer's text says likely.
- Actor
- Not named.
- Same attacker?
- Not confirmed.
Sources (2)
- 2026-11-02 Victim WorkOS October 30th, 2026 Data Security Incident
- 2026-11-03 Media BleepingComputer WorkOS says attacker used ARTEX AI to breach internal sales app