Developer identity platform WorkOS said in a security bulletin dated 2 November 2026 that on 30 October it identified unauthorised access to an internal application used by its sales team.

WorkOS says the information accessed included business contact details (names, email addresses, phone numbers, job titles and company affiliations from its CRM), customer account and relationship histories, summaries and excerpts from sales calls, support discussions and customer Slack conversations, and operational metadata about customers' product usage and connection or directory health.

It says there is no evidence that WorkOS application data or production services were accessed or affected, and that its current analysis indicates only CRM and customer-support data was affected.

WorkOS says its investigation identified the use of an AI-assisted offensive security framework to automate reconnaissance and exploitation attempts. It has disabled external access to the affected application, is reviewing access controls on internal tools, has retained an independent forensics and incident-response firm, will contact affected customers directly, and warns customers to verify unexpected requests that reference real colleagues or support conversations. (source: WorkOS)

BleepingComputer reported that, according to WorkOS's website, at least 3,000 companies use its services. (source: BleepingComputer)