The Klue-Salesforce incident involved unauthorized access to multiple customers' Salesforce instances through a compromised legacy credential at Klue. The attacker, self-identified as Icarus, used this access to generate OAuth tokens and exfiltrate business contact and CRM data in bulk via automated scripts. The breach affected over a dozen organizations, including cybersecurity firms BeyondTrust and LastPass. The attack vector was limited to the Klue integration with Salesforce, with no evidence of compromise to internal systems or LastPass customer vaults. Salesforce and Gong responded by disabling the Klue integration. The threat actor publicly listed some victims on a Tor-based leak site before it went offline. The incident highlights risks associated with third-party integrations and legacy credential management.

The impact is limited to unauthorized access and exfiltration of business contact information and CRM data from Salesforce instances integrated with Klue. No internal systems or core infrastructure of affected companies were compromised. LastPass customer vaults remain secure. The stolen data includes customer names, phone numbers, email addresses, physical addresses, support case data, and sales-related information. The breach affects the confidentiality of business and customer relationship data but does not indicate compromise of sensitive internal systems or user credentials beyond the Klue integration.

Salesforce and Gong have disabled the Klue integration to prevent further unauthorized access. Affected organizations, including LastPass, have discontinued Klue access, rotated exposed OAuth tokens, notified law enforcement, and initiated investigations with Klue and Salesforce. There is no indication that internal systems require remediation. Organizations using Klue integrations should verify token rotations and monitor for unauthorized access. Patch status is not applicable as this is an incident involving compromised credentials and third-party integration abuse rather than a software vulnerability. Check vendor advisories for updates on remediation and mitigation.