BreachPublished 26 Jun 2026

More Klue Breach Victims Identified as Hackers Get Hacked

Source SecurityWeek

Description

Roughly two dozen companies have notified their customers of the Klue-Salesforce incident impact. The post More Klue Breach Victims Identified as Hackers Get Hacked appeared first on SecurityWeek .

Impact

The breach resulted in unauthorized access to business contact and support data of Klue customers via compromised OAuth tokens. The incident affected multiple organizations using Klue's Salesforce integration, potentially exposing sensitive business information. The attack led to disruption of Klue-Salesforce integrations, which remain disabled, impacting normal operations. Secondary extortion campaigns emerged after the initial threat actor was hacked, increasing risk of further data exposure or ransom demands. No evidence of exploitation beyond data exfiltration has been publicly reported.

Defensive guidance

Salesforce and other affected integrations have been disabled by the vendors to prevent further unauthorized access. Klue is investigating the incident and has communicated privately with customers. Organizations using Klue integrations should monitor vendor communications and avoid re-enabling affected integrations until official guidance is provided. No specific mitigation steps beyond disabling integrations and investigation have been disclosed.

Summary

Between June 11 and 12, 2026, attackers exploited compromised legacy credentials to access Klue, a market intelligence platform, and obtained OAuth tokens for customers' Klue-Salesforce integrations. This allowed bulk data exfiltration affecting approximately 195 Klue customers, including notable companies such as AlertMedia, Blackbaud, and Deel. Salesforce disabled the Klue integration on June 17, and it remains disabled. The threat actor Icarus claimed responsibility and posted stolen data on a Tor-based leak site, demanding ransom. Klue engaged with Icarus, who began deleting stolen data, but was later hacked by another threat actor who initiated a separate extortion campaign using sample data. The incident highlights risks in third-party integrations and supply chain attacks but lacks public disclosure of technical remediation details.

References

securityweek.com/more-klue-breach-victims-identified-as-hackers-get-hacked/ (opens in a new tab)

Community reviews

Loading reviews…

Description

AI analysisMachine-generated, updated 26 Jun 2026, 15:06 UTC

References

Community reviews

Related threats