BreachPublished 19 Jun 2026

Klue OAuth breach victim list grows as Icarus hackers claim attack

Source Bleeping Computer

Description

Market intelligence platform Klue has publicly confirmed a recent security incident that allowed threat actors to steal OAuth tokens used to connect to customers' Salesforce environments, as the new "Icarus" extortion group publicly claims the attack. [...]

Impact

The breach resulted in unauthorized access to and theft of data from multiple customer Salesforce environments connected via Klue integrations. Stolen data includes business contacts, sales communications, pricing information, and other sensitive records. There is no evidence that Klue's own platform data or internal systems were compromised. The stolen data may be used in phishing, social engineering, and extortion campaigns against affected organizations and their contacts.

Defensive guidance

Klue has revoked the compromised credentials and OAuth tokens, removed unauthorized code, and disabled affected integrations. The company engaged cybersecurity experts (CrowdStrike) and law enforcement to investigate and respond. Affected organizations should follow Klue's guidance and monitor for phishing or extortion attempts using stolen data. Since the incident involves compromised legacy credentials, organizations should review and rotate integration credentials and tokens. Patch status is not applicable as this is a breach involving credential compromise rather than a software vulnerability.

References

bleepingcomputer.com/news/security/klue-oauth-breach-victim-list-grows-as-icarus-hackers-claim-attack/ (opens in a new tab)

Community reviews

Loading reviews…

Description

AI analysisMachine-generated, updated 19 Jun 2026, 22:41 UTC

References

Community reviews

Related threats