BeyondTrust, LastPass Impacted by Klue-Salesforce Incident
Source SecurityWeek
Description
Over a dozen Klue customers have confirmed that hackers stole data from their Salesforce instances. The post BeyondTrust, LastPass Impacted by Klue-Salesforce Incident appeared first on SecurityWeek .
Impact
The impact is limited to unauthorized access and exfiltration of business contact information and CRM data from Salesforce instances integrated with Klue. No internal systems or core infrastructure of affected companies were compromised. LastPass customer vaults remain secure. The stolen data includes customer names, phone numbers, email addresses, physical addresses, support case data, and sales-related information. The breach affects the confidentiality of business and customer relationship data but does not indicate compromise of sensitive internal systems or user credentials beyond the Klue integration.
Defensive guidance
Salesforce and Gong have disabled the Klue integration to prevent further unauthorized access. Affected organizations, including LastPass, have discontinued Klue access, rotated exposed OAuth tokens, notified law enforcement, and initiated investigations with Klue and Salesforce. There is no indication that internal systems require remediation. Organizations using Klue integrations should verify token rotations and monitor for unauthorized access. Patch status is not applicable as this is an incident involving compromised credentials and third-party integration abuse rather than a software vulnerability. Check vendor advisories for updates on remediation and mitigation.
Summary
The Klue-Salesforce incident involved unauthorized access to multiple customers' Salesforce instances through a compromised legacy credential at Klue. The attacker, self-identified as Icarus, used this access to generate OAuth tokens and exfiltrate business contact and CRM data in bulk via automated scripts. The breach affected over a dozen organizations, including cybersecurity firms BeyondTrust and LastPass. The attack vector was limited to the Klue integration with Salesforce, with no evidence of compromise to internal systems or LastPass customer vaults. Salesforce and Gong responded by disabling the Klue integration. The threat actor publicly listed some victims on a Tor-based leak site before it went offline. The incident highlights risks associated with third-party integrations and legacy credential management.
References
Community reviews
Related threats
- Hacking on Autopilot: Inside ARTEX Cybercrime CampaignsCampaign
- Cisco, WatchGuard Release Patches; SonicWall Won’t Fix GMS FlawsHighVulnerability
- Aegis Latent Core: a tamper-evident evidence chain for AI traffic. Does this help a blue team, or is it just another log source?News
- ZDI-26-870: (0Day) Ashlar-Vellum Cobalt XE File Parsing Stack-based Buffer Overflow Remote Code Execution VulnerabilityHighVulnerability
- ZDI-26-871: (0Day) Ashlar-Vellum Cobalt LI File Parsing Heap-based Buffer Overflow Remote Code Execution VulnerabilityHighVulnerability