On June 11, 2026, a supply chain attack compromised Klue's backend servers, enabling attackers to push malicious code updates that harvested OAuth tokens from customers' Klue integrations. This allowed unauthorized access to Salesforce data of Klue customers such as Huntress and Recorded Future. The attackers exploited the Salesforce REST API to exfiltrate large volumes of CRM data, including business contacts, price quotes, and sales-related messaging, over a 24-hour window with intense query bursts. Klue responded by deactivating all OAuth tokens and disabling integrations with Salesforce and other platforms. Salesforce disabled the Klue Battlecards app integration due to detected unusual activity. The attack did not compromise the internal systems of affected cybersecurity firms. Attribution points to the Icarus extortion group, linked to prior extortion attempts and data leaks. Klue has not publicly disclosed a patch or remediation beyond token deactivation and integration disabling.

The attack resulted in unauthorized exfiltration of business-related CRM data from Salesforce instances of Klue customers, including client contact information, price quotes, and sales messaging. Sensitive data such as threat intelligence, passwords, payment card information, or engineering telemetry was not accessed. The incident affected the confidentiality of business data for impacted customers. No direct compromise of the affected firms' own systems occurred. The disruption included disabling of OAuth tokens and integrations, impacting operational connectivity with Salesforce and other platforms.

Klue has deactivated all OAuth tokens and disabled affected integrations to contain the incident. Salesforce disabled the Klue Battlecards app integration to prevent further unauthorized access. Customers should verify that OAuth tokens have been reset and integrations remain disabled or are reconfigured securely. Monitor vendor advisories for any official patches or updates from Klue. As of the report, no official patch or fix has been announced. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance.