Around 100 Domestic Claude Accounts Exposed... "On-Site Inspections of Foreign Companies Inevitably Face Constraints"

Anthropic Reported the Breach on October 31
Investigation Procedures Same for Domestic and Foreign Companies, but On-Site Inspections May Face Constraints

Information on around 100 domestic business accounts was exposed through Claude, a generative AI service from U.S. artificial intelligence (AI) company Anthropic. As Anthropic has expanded its user base and strengthened its foothold in the Korean market, attention is focused on how effectively the personal data breach will be investigated.

According to the Personal Information Protection Commission (PIPC) on November 10, Anthropic reported on October 31 that information on around 100 domestic business Claude accounts had been exposed externally. The PIPC is currently verifying the facts and has not yet launched a formal investigation.

Anthropic is said to have sent notices to some corporate customers stating that information such as business Claude account details, organization identification numbers, names, and email addresses may have been exposed in the incident.

The incident is believed to have occurred when an external security firm exploited a vulnerability in third-party software to gain unauthorized access to Anthropic's internal systems. The Washington Post reported on October 26 (local time) that U.S. cybersecurity startup Cathedral had accessed Anthropic's internal systems through a vulnerability in external business software.

In the process, account-related information, including business Claude account details, organization identification numbers, user names, and email addresses, may have been exposed. Lydia Harley, an Anthropic technology researcher, said, "There was unauthorized access to account information, but no access to prompts, outputs, or payment information."

Investigation procedures for personal data breaches apply equally to domestic and foreign companies. After reviewing a report to determine how the breach occurred and whether there may have been any violations of the law, the PIPC launches a formal investigation. Under Article 63 of the Personal Information Protection Act, it may require businesses to submit relevant materials and, if certain requirements are met, conduct on-site inspections. If an investigation confirms violations, the PIPC may issue corrective orders or impose administrative fines.

However, practical constraints may arise when securing materials in advance and conducting on-site inspections of foreign companies. Before a formal investigation, the PIPC typically asks the business to provide information on the circumstances of the incident, the types of personal data exposed, and revenue figures needed to calculate administrative fines. Foreign companies may take longer than domestic companies to submit materials and respond during this process. Companies headquartered overseas may also have information systems located at overseas offices, creating physical distance and making direct on-site visits difficult. As a result, even though the legal investigation procedures are the same, the actual investigation may differ.

A PIPC official said, "We are currently verifying the facts, including the cause of the breach, who was responsible, and whether safety measures were in place," adding, "If we confirm any potential legal violations, we will launch a formal investigation."

This content was produced with the assistance of AI translation services.