{"resourceId":"anthropic-enterprise-notice-account-usage-spend-fields-20261109","versions":[{"version":"external-23ada14a25958fac79d7ed037512748613e7a32a2b3d4884db88fdab838f4411","resource":{"id":"anthropic-enterprise-notice-account-usage-spend-fields-20261109","title":"Report on Anthropic enterprise notice: exposed fields include org IDs, plan tier, usage and spend; Anthropic cannot confirm whose data was viewed","organization":"Complete AI Training (news)","sector":"Technology news / training publisher","geography":"Global","publishedAt":"2026-11-10T00:18Z (Nov. 9, 2026 CT)","publicationDate":"2026-11-09","eventDate":"2026-11-07","sourceName":"Complete AI Training","sourceLabel":"Secondary news report by an AI training company","sourceUrl":"https://completeaitraining.com/news/anthropic-tells-enterprise-customers-a-security-firm/","evidenceClass":"independent-reporting","outcomeClass":"cautionary","topics":["data-security","governance-procurement"],"finding":"This report describes the Anthropic customer notice shared publicly on Nov. 7: exposed enterprise fields include account ID, organization ID, plan tier, usage and spend metrics, but not conversation content, passwords or payment data. Anthropic says it disabled access, fixed vulnerabilities, received written certification of deletion, reported to Korean authorities, and \"cannot confirm whether any particular person's information was viewed.\" The notice leaves it to customer organizations to decide whether to warn their own staff.","sledRelevance":"Interpretation: for public employers, usage and spend metrics can be public-records-sensitive and union-sensitive, and the decision to notify staff falls on the agency or campus. Combined with the Korean regulator report, this gives SLED privacy offices concrete fields to assess under state breach laws.","evidence":"Secondary reporting of the notice text with quotes; corroborates regulator report; no independent forensic data.","architectureImplications":"Interpretation: limited; reinforces separating admin identities and minimizing account metadata shared with SaaS vendors.","governanceImplications":"Interpretation: agencies need a documented decision on whether to notify employees and whether state breach statutes are triggered.","securityPrivacyImplications":"Third-party administrative and sales software was the attack path, not Claude itself, per reporting.","caveats":"Publisher sells AI training and includes promotional links; relies on a researcher's post of the notice and WaPo reporting; Anthropic has not publicly confirmed the notice concerns Cathedral.","streamIds":["anthropic"],"roles":{"sales":"Frame this as helping customers make a notification decision. The reported notice lists account IDs, plan tier, usage and spend metrics as exposed and says Anthropic cannot confirm whose data was viewed, leaving staff notification to the customer. Ask whether usage data ties to named employees and whether state breach law applies. Offer a bounded notification assessment. Do not claim legal conclusions or that conversation data was safe beyond what Anthropic stated.","engineering":"Engineering input is mainly scoping: determine what account and usage data Anthropic holds about the tenant, whether usage metrics map to named staff, and whether admin identities need rotation. Prerequisites: admin console exports and identity logs. Constraint: secondary source with promotional content. Proof of value: produce an inventory of tenant metadata held by the vendor and verify hardening of admin accounts.","delivery":"Delivery should coordinate privacy, legal, HR and security to decide on staff notification, document the reasoning, and update the vendor-risk file. Dependencies include written confirmation from Anthropic and legal review of state breach statutes. Ownership sits with the privacy officer. Risks include inconsistent notifications across agencies or campuses and reputational harm from late disclosure. Acceptance is a documented notification decision within incident timelines."},"roleDetails":{"sales":{"customerProblem":"Public employers must decide whether to notify staff about a vendor incident with uncertain individual scope.","stakeholders":["Privacy officer","General counsel","HR / labor relations","CISO"],"discoveryQuestions":["Do usage metrics identify named employees?","Does state breach law cover these fields?","Who decides on staff notification?"],"valueHypothesis":"A documented notification decision reduces legal and reputational risk.","potentialEngagement":"Notification assessment and communications plan.","unsupportedClaims":["Legal conclusions on breach statutes","Data was certainly not viewed","Conversation content was proven untouched by independent audit"]},"engineering":{"fit":"Scoping input for incident response.","architectureIntegration":"Inventory vendor-held metadata; minimize identifiable usage data where possible.","prerequisites":["Admin console exports","Identity logs"],"constraints":["Secondary source","Vendor has not publicly named the firm"],"security":"Attack path via third-party business software at the vendor.","proofOfValue":["Metadata inventory","Admin hardening verification"]},"delivery":{"work":"Coordinate notification decision and update vendor-risk file.","dependencies":["Vendor confirmation","Legal review"],"ownership":"Privacy officer.","skillsAdoption":"Prepare template communications for vendor incidents.","governanceCheckpoints":["Legal breach analysis","HR/union consultation"],"acceptanceCriteria":["Proposed: decision documented within agency incident timelines","Proposed: consistent message across units"],"risks":["Inconsistent notification","Late disclosure"]}},"retrievedAt":"2026-11-10T04:09:34Z","enrichedAt":"2026-11-10T04:18:20Z","enrichmentBasis":"retrieved source","accessibilityWorkforceImplications":"Interpretation: employee notifications should be plain-language and accessible; not addressed by the source.","procurementImplications":"Interpretation: data-use agreements should cover vendor-side business systems holding customer account data.","operatingModelImplications":"Interpretation: privacy and HR must coordinate on staff communications for vendor incidents.","sourceVerification":{"openedUrl":"https://completeaitraining.com/news/anthropic-tells-enterprise-customers-a-security-firm/","referenceExcerpt":"The exposed fields for enterprise Claude accounts go beyond names and email addresses.","promptVersion":"sled-research-v4.0","model":null,"basis":"agent-reported inspection"}}}]}