Klue supply-chain breach exposes customers' Salesforce data

On 19 June 2026, cybersecurity firms Huntress and Recorded Future disclosed that their Salesforce data had been stolen through a supply-chain compromise of Klue — the Vancouver-based competitive-intelligence and win-loss platform whose app integrates with customers' CRMs. The breach is a textbook example of how a single trusted SaaS vendor can become a conduit into the data of many downstream organisations.

What happened

According to Klue's customer notifications and the affected firms' disclosures, attackers first gained access to Klue's backend infrastructure using a long-dormant API credential that had originally been created for an abandoned third-party integration prototype. From that foothold they pushed a code update designed to harvest OAuth tokens for customers' connected applications. Those tokens were then used to reach into customers' downstream systems — most prominently their Salesforce instances — and exfiltrate data.

Klue detected and contained the unauthorised activity on the morning of 12 June 2026, and moved to deactivate OAuth tokens for all customers while disabling its integrations with Salesforce, HubSpot, SharePoint, Zoom, Gong, Chorus, Clari, Google Drive and Slack. On 17 June 2026, Salesforce independently disabled the Klue "Battlecards" connected app, warning that unusual activity may have resulted in unauthorised access to a subset of customer data via the app's connection to Salesforce.

Impact

The downstream victims were customers who had connected Klue to their CRMs. Recorded Future said it was not specifically targeted but was an incidental victim of the compromised Salesforce-to-Klue integration, and that the impact appeared limited to business data fields stored in its Salesforce database — such as client contact names and email addresses, with certain business contract information potentially also included. Huntress likewise confirmed that some of its Salesforce data was exfiltrated. The total number of Klue customers affected was not disclosed.

Attribution

Huntress reported receiving an attempted extortion communication from a threat actor calling itself "Mr Brean," who pointed to a Session Messenger identifier associated with Icarus, an extortion group that emerged in April 2026. On the strength of those matching data points, Huntress stated it had high confidence that the Icarus actor was responsible for the Klue compromise.

Why it matters

The Klue incident underscores a recurring theme in modern breaches: the security of an organisation is bounded by the security of the SaaS apps it grants access to. A forgotten credential for a deprecated integration was enough to turn a vendor into a launch pad, and OAuth tokens — designed for convenience — became the keys that unlocked customers' CRM data. It also reflects the continued targeting of Salesforce-connected third-party apps as a high-value path to corporate data, reinforcing why organisations should inventory connected apps, scope OAuth grants tightly, and retire dormant credentials.