Anthropic has told business customers a security firm saw their account details, so read the next 'Claude billing' email twice
By Brett Gavaghan, Founder of Adaptd ·
Anthropic is emailing business customers to say an outside cybersecurity firm had unauthorised access to their contact and account information. Chats, passwords and payment details weren't involved.
The short version
- Anthropic says an unnamed cybersecurity research firm had unauthorised access to business customers' contact and account information.
- For Claude Enterprise accounts, this included plan tier and spend figures, but not chats or passwords.
- Tell the people named on your Claude account to treat unexpected Anthropic emails with care and check details in the admin console.
Nobody likes an email that starts with "Notice regarding your organisation's account information". Anthropic sent a lot of them, and the content is calmer than the subject line.
What did Anthropic tell its business customers?
Anthropic told business customers that a third-party cybersecurity research company had unauthorised access to their business contact and account information. Security researcher Jamieson O'Reilly posted the notice on X on 7 November.
For organisations on Claude Enterprise, the notice lists account ID, organisation ID, plan tier, usage and spend metrics among the affected details. It says the data doesn't include the content of conversations with Claude, passwords, or payment card and bank account details.
What has Anthropic done about it?
Anthropic says it cut off the firm's access and fixed the weaknesses it found. It has also opened an investigation. The firm has certified in writing that it deleted the data, and Anthropic reported the incident to Korean authorities.
The notice doesn't name the firm or say how many customers were affected. It matches the access Anthropic confirmed in October, when AI agents run by a startup called Cathedral reached some of its internal business systems through outside business software. Anthropic also says it can't confirm whether any particular person's details were viewed.
What should your business do about it?
Your business should tell the people named on your Claude account, usually the admins and billing contacts, that their details may have been seen.
My advice: the risk here isn't your chats, it's a convincing email. Someone who knows your plan tier and roughly what you spend can write a very believable "your Claude invoice failed" message. Check anything like that by logging in to the admin console yourself, not by clicking the link. If you're on a personal Pro plan, this notice is aimed at business accounts, so it's a reminder rather than a job.
Telling three staff to be suspicious of a billing email takes two minutes. Explaining why the company card is in Lithuania takes longer.
Sources
Wondering what this means for your business?
That's exactly what the discovery call is for.