WorkOS October 30 incident update

Evidence record

First-party incident reconstruction of unauthorized use of an internal administration tool and ARTEX-assisted record extraction.

Read the original source ↗

Claim-level citations (3)

• supportsARTEX-assisted intrusion used weak access controls on a WorkOS internal tool: WorkOS says the attack included ARTEX scanning and access to an internally developed production tool using a predictable development credential, followed by bulk record retrieval on October 30.

  Incident timeline and contributing factors: public API, weak credentials, absent rate limiting

• supportsARTEX-assisted intrusion used weak access controls on a WorkOS internal tool: WorkOS reports initial unauthorized API access on October 25 and detection on October 30 after a connected-system usage anomaly, rather than automated alerting at the first request.

  Investigation timeline; detection and telemetry gaps

• supportsARTEX-assisted intrusion used weak access controls on a WorkOS internal tool: WorkOS attributes its internal-tool exposure to public network reachability, a weak development credential, missing rate limits and delayed detection; it reports bulk sales and support data retrieval on October 30 and remedial access restrictions by October 31.

  Incident timeline; Impact; Four contributing gaps; Security Improvements