Klue: legacy integration credential used to steal OAuth tokens and bulk-export customers’ Salesforce data

What happened

• Klue said it found “unauthorized activity affecting a portion of Klue’s integration infrastructure” on 12 Jun; no content stored in its own platform was affected. FINRA says the actor stole customer OAuth tokens used by Klue Battlecards and used them with automated Python scripts to bulk-exfiltrate CRM data (business contacts, support cases, BI reports); more than a dozen organizations confirmed impact. Named victims include Recorded Future, Tanium, Jamf, Sprout Social, Gong, Insurity, Huntress, OneTrust and LastPass (LastPass confirmed on 23 Jun).
• Root cause: “a compromised legacy credential” tied to an integration service account (Klue); TechCrunch reports it was issued in 2022 for a limited pilot and never decommissioned.
• Icarus extortion group claimed it (alias “mr bean”); Microsoft tracks the actor as Storm-3138 per the catalogue.
• Salesforce and Gong disabled the Battlecards integration; Klue revoked tokens and engaged CrowdStrike; TechCrunch reports Klue reached a deal with the hackers not to publish.

Sources

• https://www.finra.org/rules-guidance/guidance/cybersecurity-alert-klue-oauth-breach-and-salesforce-data-exfiltration
• https://www.bleepingcomputer.com/news/security/klue-oauth-breach-victim-list-grows-as-icarus-hackers-claim-attack/
• https://www.bleepingcomputer.com/news/security/lastpass-confirms-data-breach-in-klue-supply-chain-attack/

This is a brief: a short, sourced summary from our incident tracking. Full advisories add commands to check whether you are affected.