Breachesby GlyphAnthropic
Disclosed Aug 31, 2026Unverified
Infostealer-stolen session cookies used to hijack Claude accounts
Anthropic emailed users and signed them out after finding their Claude login sessions had been stolen by infostealer malware such as Vidar, Lumma, StealC, RedLine, Acreed and Atomic Stealer; it removed saved payment methods and refunded unauthorized Claude charges.
What is known
| People affected | Not stated in the sources we have |
|---|---|
| Disclosed | Aug 31, 2026 |
| Attack | Hacking |
| Data exposed | Credentials and tokensPayment cardsPrompts and chats |
| Sector | AI · US |
| Status | Unverified: not yet confirmed by an official notice, a filing or the organization |
Sources
Notices filed
Other breaches at Anthropic
Shared Claude conversations appeared in Google search resultsExposed data exposed prompts and chats, messages and source code.Exposed dataAIUSUnverifiedJul 27Claude Code source code accidentally published in npm packageExposed data exposed source code.Exposed dataAIUSUnverifiedMar 31DeepSeek, Moonshot and MiniMax used 24,000 fraudulent accounts to distill ClaudeAI or model exposed training data.AI or modelAIUSFeb 23Chinese state group manipulated Claude Code to attack about 30 organizationsHacking exposed internal documents and credentials and tokens.HackingAIUSNov 13, 2025Cybercriminal used Claude Code to steal and extort data from at least 17 organizationsExtortion exposed financial details, health records and credentials and tokens.ExtortionAIUSAug 27, 2025Contractor mistakenly emailed file of customer names and credit balances to third partyInsider exposed names and financial details.InsiderAIUSUnverifiedJan 29, 2024
History of this record
First recordedby seedSource
First seen 2026-09-25 (Research). Record counts are as reported. Not legal advice.