Klue OAuth breach victim list grows as Icarus hackers claim attack
Market intelligence platform Klue has publicly confirmed a recent security incident that allowed threat actors to steal OAuth tokens used to connect to customers' Salesforce environments, as the new "Icarus" extortion group publicly claims the attack. [...]
AI Analysis
Technical Summary
On June 12, 2026, Klue identified unauthorized activity involving a compromised legacy credential linked to an integration service. Attackers used this access to steal OAuth tokens that connect Klue to third-party platforms such as Salesforce. Using these tokens, attackers accessed and exfiltrated data from multiple customer Salesforce environments. The breach was limited to third-party integrations; Klue's own platform data was not impacted. The Icarus extortion group publicly claimed responsibility and has used the stolen data to pressure victims. Klue responded by revoking credentials, removing unauthorized code, disabling integrations, and involving CrowdStrike and law enforcement. Cybersecurity firms Huntress and ReliaQuest confirmed the attackers used Python scripts to query Salesforce APIs over extended periods to steal data.
Potential Impact
The breach resulted in unauthorized access to and theft of data from multiple customer Salesforce environments connected via Klue integrations. Stolen data includes business contacts, sales communications, pricing information, and other sensitive records. There is no evidence that Klue's own platform data or internal systems were compromised. The stolen data may be used in phishing, social engineering, and extortion campaigns against affected organizations and their contacts.
Mitigation Recommendations
Klue has revoked the compromised credentials and OAuth tokens, removed unauthorized code, and disabled affected integrations. The company engaged cybersecurity experts (CrowdStrike) and law enforcement to investigate and respond. Affected organizations should follow Klue's guidance and monitor for phishing or extortion attempts using stolen data. Since the incident involves compromised legacy credentials, organizations should review and rotate integration credentials and tokens. Patch status is not applicable as this is a breach involving credential compromise rather than a software vulnerability.
Klue OAuth breach victim list grows as Icarus hackers claim attack
Description
Market intelligence platform Klue has publicly confirmed a recent security incident that allowed threat actors to steal OAuth tokens used to connect to customers' Salesforce environments, as the new "Icarus" extortion group publicly claims the attack. [...]
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
On June 12, 2026, Klue identified unauthorized activity involving a compromised legacy credential linked to an integration service. Attackers used this access to steal OAuth tokens that connect Klue to third-party platforms such as Salesforce. Using these tokens, attackers accessed and exfiltrated data from multiple customer Salesforce environments. The breach was limited to third-party integrations; Klue's own platform data was not impacted. The Icarus extortion group publicly claimed responsibility and has used the stolen data to pressure victims. Klue responded by revoking credentials, removing unauthorized code, disabling integrations, and involving CrowdStrike and law enforcement. Cybersecurity firms Huntress and ReliaQuest confirmed the attackers used Python scripts to query Salesforce APIs over extended periods to steal data.
Potential Impact
The breach resulted in unauthorized access to and theft of data from multiple customer Salesforce environments connected via Klue integrations. Stolen data includes business contacts, sales communications, pricing information, and other sensitive records. There is no evidence that Klue's own platform data or internal systems were compromised. The stolen data may be used in phishing, social engineering, and extortion campaigns against affected organizations and their contacts.
Mitigation Recommendations
Klue has revoked the compromised credentials and OAuth tokens, removed unauthorized code, and disabled affected integrations. The company engaged cybersecurity experts (CrowdStrike) and law enforcement to investigate and respond. Affected organizations should follow Klue's guidance and monitor for phishing or extortion attempts using stolen data. Since the incident involves compromised legacy credentials, organizations should review and rotate integration credentials and tokens. Patch status is not applicable as this is a breach involving credential compromise rather than a software vulnerability.
Technical Details
- Article Source
- {"url":"https://www.bleepingcomputer.com/news/security/klue-oauth-breach-victim-list-grows-as-icarus-hackers-claim-attack/","fetched":true,"fetchedAt":"2026-06-19T22:41:37.245Z","wordCount":867}
Threat ID: 6a35c5a1daaa79a87d4653e5
Added to database: 6/19/2026, 10:41:37 PM
Last enriched: 6/19/2026, 10:41:45 PM
Last updated: 6/20/2026, 1:26:20 AM
Views: 4
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
External Links
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.