Vanta Bug Exposed Customer Data to Other Clients

In a recent security incident, compliance automation company Vanta revealed that a software bug caused private customer data to be exposed to other customers on its platform. This exposure was not the result of a malicious intrusion but stemmed from a product code change, highlighting how even routine updates can introduce significant risks.

Vanta, which specializes in automating security and compliance processes for corporate clients, identified the issue on May 26, 2025. The company expects to complete remediation by June 4, 2025. According to Vanta’s chief product officer Jeremy Epling, the bug caused a subset of data from fewer than 20% of their third-party integrations to be visible to other customers.

While fewer than 4% of Vanta’s more than 10,000 customers were affected, this still likely means hundreds of companies had some data exposure. Affected customers have been notified, with details indicating that employee account data—including names, roles, and security configurations like multi-factor authentication usage—was mistakenly shared across customer instances.

One customer confirmed receiving notification about the exposure, which involved data being erroneously pulled into and out of their Vanta instance. However, Vanta has not disclosed whether internal employee data was compromised or the specific types of customers impacted.

Founded in 2018, Vanta has rapidly grown, raising over $350 million in funding, including a $150 million Series C round in July 2024. This incident underscores the challenges compliance and security automation platforms face in safeguarding sensitive data while scaling rapidly.

Lessons from the Vanta Data Exposure Incident

This incident highlights several critical points for organizations relying on compliance automation tools:

• Code changes, even routine ones, can unintentionally expose sensitive data if not thoroughly tested.
• Transparency with customers and swift remediation are essential to maintaining trust after a data exposure.
• Companies must continuously monitor and audit third-party integrations to prevent cross-customer data leaks.
• Security automation platforms should implement rigorous safeguards around data segregation to protect customer privacy.

For businesses, this incident is a reminder that even trusted compliance tools require oversight and contingency planning for potential vulnerabilities.