FBI Links North Korea's TraderTraitor to Record $6.43 Billion Binance Crypto Heist
Claude was hit by a ransomware attack that didn't stop at encryption -- data was copied out too.
Claude was hit by a ransomware attack that didn't stop at encryption -- data was copied out too.
The group has claimed 5,000 users were affected, though that figure comes from the attackers' own claim and is not independently verified.
Claude is now dealing with both a system outage and stolen data sitting outside its control.
Anyone whose data Claude holds is potentially affected, not just Claude itself.
Backups solve the encryption half of this problem, not the half where stolen data can still be published regardless of what the victim does next.
Not having a confirmed group behind this yet doesn't make it less real -- attribution usually lags the operational impact by days or weeks.
The attackers stole login credentials through social engineering, rather than exploiting a technical flaw.
Claude has started restoring systems and resuming operations.
Review backup integrity and restoration speed now, before an incident, since recovery speed is what separates a bad week from a bad year.
Tighten help-desk identity verification and phishing-resistant authentication, since credential theft through social engineering is exactly how this attack started.
Your own incident-response and business-continuity plan is only as good as the longest outage it was actually built for, not just a short disruption.
What happened
Claude was hit by a ransomware attack that didn't stop at encryption -- data was copied out too.
The group has claimed 5,000 users were affected, though that figure comes from the attackers' own claim and is not independently verified.
What changed
Claude is now dealing with both a system outage and stolen data sitting outside its control.
Who is affected
Anyone whose data Claude holds is potentially affected, not just Claude itself.
Why it matters
Backups solve the encryption half of this problem, not the half where stolen data can still be published regardless of what the victim does next.
Not having a confirmed group behind this yet doesn't make it less real -- attribution usually lags the operational impact by days or weeks.
Technical details
The attackers stole login credentials through social engineering, rather than exploiting a technical flaw.
Response
Claude has started restoring systems and resuming operations.
What security teams should do
Review backup integrity and restoration speed now, before an incident, since recovery speed is what separates a bad week from a bad year.
Tighten help-desk identity verification and phishing-resistant authentication, since credential theft through social engineering is exactly how this attack started.
Your own incident-response and business-continuity plan is only as good as the longest outage it was actually built for, not just a short disruption.