Summary
- Environment: Internal sales and customer-support application
- Operational impact: CRM contacts, communications and usage metadata accessed
- Financial impact: No incident cost disclosed
- Record status: Developing record. Reviewed November 3, 2026; updated as evidence emerges.
What happened
Impact
Accessed information included business contacts, account histories, communication summaries and excerpts, and product-usage and connection-health metadata. [1]
WorkOS reported no evidence of access to its application data or production services, and continued assessing individual customer impact. [1]
Timeline
Unauthorized access identified
Unauthorized access identified, as described in the company notice.
[1]Security bulletin published
Security bulletin published, as described in the company notice.
[1]Briefing updated
This briefing was last reviewed and updated on November 3, 2026.
Threat Group & Attack Vector
WorkOS said its investigation identified an AI-assisted offensive security framework used for reconnaissance and exploitation attempts. The bulletin does not identify a framework, actor or initial exploit. [1]
Actors
- No threat actor group has been identified in the reviewed public evidence.
TTPs
- No specific MITRE ATT&CK technique is currently mapped for this case.
Response
WorkOS disabled external access to the tool, reviewed internal access controls, engaged independent forensic specialists and planned direct customer notifications. [1]