NewsPublished 22 Jun 2026

More Cybersecurity Firms Disclose Impact From Klue Hack

Source SecurityWeek

Description

HackerOne, Huntress, Jamf, OneTrust, Recorded Future, Snyk, and Tanium are among the affected Klue customers. The post More Cybersecurity Firms Disclose Impact From Klue Hack appeared first on SecurityWeek .

Impact

The attack resulted in unauthorized access and exfiltration of business and contact information from the Salesforce instances of multiple Klue customers. This includes sensitive sales account data and personal business contact details (names, emails, job titles, phone numbers, business addresses). There is no evidence that data stored directly within the Klue platform was compromised. The incident impacted the confidentiality of customer Salesforce data but did not affect the customers' own internal systems. The threat actor's public claims and extortion attempts increase reputational risk and potential exposure of stolen data.

Defensive guidance

Klue has revoked the compromised legacy credentials and OAuth tokens and disabled the affected integrations. Customers should verify that Salesforce integrations with Klue are disabled or secured and monitor for unauthorized access. Since the attack was limited to third-party integrations, no direct action on Klue platform data is required. Organizations should follow vendor advisories and coordinate with Klue and Salesforce for updates. Law enforcement and CrowdStrike are involved in the investigation. Patch status is not applicable as this is a credential compromise and integration misuse rather than a software vulnerability.

Summary

In June 2026, Klue suffered a supply chain attack where attackers exploited compromised legacy credentials to access OAuth tokens connecting Klue to third-party platforms, notably Salesforce. This allowed unauthorized access to Salesforce environments of multiple Klue customers, including cybersecurity firms like HackerOne, Huntress, Jamf, OneTrust, Recorded Future, Snyk, and Tanium. The attackers exfiltrated business information such as sales account data and business contact details. Klue responded by revoking credentials, disabling integrations, and working with CrowdStrike and law enforcement. The compromise was limited to third-party platforms; Klue's own stored customer content was not impacted. The threat actor Icarus publicly claimed responsibility and threatened data release.

References

securityweek.com/more-cybersecurity-firms-disclose-impact-from-klue-hack/ (opens in a new tab)

Community reviews

Loading reviews…

Description

AI analysisMachine-generated, updated 22 Jun 2026, 09:24 UTC

References

Community reviews