Data breach: Company, international 2025
A perpetrator (GTG-2002) used Claude Code to steal data from at least 17 organisations and threatened publication instead of encryption.
- Incident · 08.2025 · international, international
- Evidence: confirmed by an authority
- Data breach
- AI link
As of
What happened
According to Anthropic, the AI also made tactical and strategic decisions, for example on the amount of the demands. Anthropic blocked the accounts, built new detection filters and passed indicators on to the authorities.
Role of AI: «Vibe hacking»: Claude Code automated reconnaissance and intrusion, selected the data to be stolen, evaluated financial data to set the amount of the demand and wrote the extortion letters.
- Affected
- Company (anonymous)
- Industry
- several industries
- Loss
- no reliable figure
- Business interruption
- unknown
- Ransom demanded / paid
- yes / unknown
- Data affected
- true
- Bankruptcy
- no
- Entry point
- Automated reconnaissance and stolen login data, carried out with Claude Code
What would cyber insurance have paid?
That depends on the terms. Whether those affected were insured: unknown.
-
Help and negotiation; only some insurers pay the ransom, see note
Mostly add-on 6 of 9 business products cover it fully, as an add-on or with limits.
-
Third-party claims after a data breach
Liability for data protection and network security breaches
Mostly covered 7 of 9 business products cover it fully, as an add-on or with limits.
-
Letters, call centre, credit monitoring
Mostly covered 6 of 9 business products cover it fully, as an add-on or with limits.
-
Proceedings before authorities
Costs of FDPIC or GDPR proceedings, usually not fines
Mostly limited 6 of 9 business products cover it fully, as an add-on or with limits.
-
Loss of income because customers stay away after the incident
Mostly no information 1 of 9 business products cover it fully, as an add-on or with limits.
Overview based on public policy terms, as of 06.11.2026. Only your policy and its general terms and conditions (GTC) are binding. No confirmation of cover.
What we can learn
Even without encryption, perpetrators extort with stolen data; detecting data exfiltration early is as important as backups.
Sources
- Detecting and countering misuse of AI: August 2025 (opens in a new window) Anthropic · 2025-08-27
«Claude was allowed to make both tactical and strategic decisions.»
- Cybercriminals Exploit Anthropic's AI in Global Extortion Campaign (opens in a new window) Bitdefender · 2025-08