---
title: "WorkOS internal sales-tool data incident"
description: "WorkOS disclosed unauthorized access to an internal sales tool containing customer contacts, communications and product usage metadata."
incident_type: "Cybersecurity incident"
status: "active"
last_modified: "2026-11-03"
canonical_url: "https://www.ally.security/incidents/workos-internal-sales-tool-data-incident-2026"
markdown_url: "https://www.ally.security/incidents/workos-internal-sales-tool-data-incident-2026.md"
stix_url: "https://www.ally.security/incidents/workos-internal-sales-tool-data-incident-2026/stix.json"
---

# WorkOS internal sales-tool data incident

WorkOS identified unauthorized access to an internal sales application on October 30, 2026.

Last modified Nov 3, 2026 · 1 source

## Summary

- **Environment:** Internal sales and customer-support application
- **Operational impact:** CRM contacts, communications and usage metadata accessed
- **Financial impact:** No incident cost disclosed

## What happened

[WorkOS](https://workos.com/) identified unauthorized access to an internal sales application on October 30, 2026. [1](#source-1)

## Impact

Accessed information included business contacts, account histories, communication summaries and excerpts, and product-usage and connection-health metadata. [1](#source-1)

WorkOS reported no evidence of access to its application data or production services, and continued assessing individual customer impact. [1](#source-1)

## Timeline

### October 30, 2026 — Unauthorized access identified

Unauthorized access identified, as described in the [company notice](https://workos.com/security/bulletins/october-30th-2026-data-security-incident). [1](#source-1)

### November 2, 2026 — Security bulletin published

Security bulletin published, as described in the [company notice](https://workos.com/security/bulletins/october-30th-2026-data-security-incident). [1](#source-1)

### November 3, 2026 — Briefing updated

This briefing was last reviewed and updated on November 3, 2026.

## Threat Group & Attack Vector

WorkOS said its investigation identified an AI-assisted offensive security framework used for reconnaissance and exploitation attempts. The bulletin does not identify a framework, actor or initial exploit. [1](#source-1)

### Actors

- No threat actor group has been identified in the reviewed public evidence.

### TTPs

- No specific MITRE ATT\&CK technique is currently mapped for this case.

## Response

WorkOS disabled external access to the tool, reviewed internal access controls, engaged independent forensic specialists and planned direct customer notifications. [1](#source-1)

## Assets

[Download the case-scoped STIX 2.1 bundle](<https://www.ally.security/incidents/workos-internal-sales-tool-data-incident-2026/stix.json>)

## Sources

Primary source records used to research this incident.

<a id="source-1"></a>

### October 30th, 2026 Data Security Incident

official · WorkOS · Nov 2, 2026

<https://workos.com/security/bulletins/october-30th-2026-data-security-incident>

<details>
<summary>Evidence ledger</summary>

Review the supporting structured claims.

1. **Resulted In · 100% confidence · current**  
   WorkOS internal sales-tool data incident: WorkOS identified unauthorized access to an internal sales application on October 30, 2026.
2. **Occurred At · 100% confidence · current**  
   Security bulletin published: 2026-11-02
3. **Resulted In · 100% confidence · current**  
   WorkOS internal sales-tool data incident: Unauthorized access identified
4. **Resulted In · 100% confidence · current**  
   WorkOS internal sales-tool data incident: Accessed information included business contacts, account histories, communication summaries and excerpts, and product-usage and connection-health metadata.
5. **Disclosed At · 100% confidence · current**  
   WorkOS internal sales-tool data incident: 2026-11-02
6. **Discovered At · 100% confidence · current**  
   WorkOS internal sales-tool data incident: 2026-10-30
7. **Resulted In · 100% confidence · current**  
   WorkOS internal sales-tool data incident: Security bulletin published
8. **Affected Organization · 100% confidence · current**  
   WorkOS internal sales-tool data incident: WorkOS
9. **Resulted In · 100% confidence · current**  
   WorkOS internal sales-tool data incident: WorkOS reported no evidence of access to its application data or production services, and continued assessing individual customer impact.
10. **Resulted In · 100% confidence · current**  
   WorkOS internal sales-tool data incident: WorkOS disabled external access to the tool, reviewed internal access controls, engaged independent forensic specialists and planned direct customer notifications.
11. **Occurred At · 100% confidence · current**  
   Unauthorized access identified: 2026-10-30
12. **Resulted In · 100% confidence · current**  
   WorkOS internal sales-tool data incident: WorkOS said its investigation identified an AI-assisted offensive security framework used for reconnaissance and exploitation attempts. The bulletin does not identify a framework, actor or initial exploit.

</details>