WorkOS reports security breach | Hacker News

WorkOS, the authentication and user-management infrastructure provider, disclosed a data security incident detected on October 30, 2026, at 16:39 UTC, after identifying anomalous traffic to an internal business system. The company said the attack was likely driven by ARTEX, an AI-assisted, autonomous penetration testing framework, originating from IP addresses based in Hong Kong and China. The unauthorized actor accessed an internal API used by sales and marketing tools, exposing data from the company's Salesforce and Snowflake instances, including CRM information such as names, email addresses, phone numbers, company mailing addresses, and support tickets. WorkOS said there is no evidence that customer application data or production WorkOS services were accessed or impacted, with the incident localized to CRM and customer support data. The breach notification was shared by a recipient on Hacker News but had not yet appeared on WorkOS's website or Trust Center at the time of reporting. Investors and customers should watch for updates on the investigation's scope, whether regulated customer data was affected, and any potential impact on enterprise contracts or the company's security certifications.