klue breach turns stolen oauth tokens into customers' crm data

what happened

• Klue said it identified unauthorized activity in part of its integration infrastructure on June 12, 2026, and that the attacker got in through a compromised legacy credential tied to an integration service.[1]
• The attacker used that access to obtain OAuth tokens connecting Klue to third-party platforms, including Salesforce, then accessed data in connected customer environments. Klue says there is no evidence that content stored in the Klue platform itself was affected.[1]
• FINRA says the stolen tokens covered Klue Battlecards integrations with Salesforce, HubSpot, SharePoint, Zoom, Gong, Chorus, Clari, Google Drive and Slack, and that the attacker bulk-exported CRM data from Salesforce with automated Python scripts.[2]
• According to FINRA, the stolen data included business contact information, support case data and business intelligence reports.[2]
• According to FINRA, Salesforce and Gong disabled the Klue Battlecards integration. Salesforce, as quoted by The Hacker News and GovInfoSecurity, said the issue "is limited to Klue's app connection and does not arise from a vulnerability within the Salesforce platform."[2,3,4]
• FINRA says more than a dozen organizations have confirmed impact, including LastPass, Huntress, Jamf, Tanium, HackerOne, Snyk, OneTrust and BeyondTrust, and that a threat actor identifying itself as Icarus is conducting an ongoing extortion campaign against affected organizations.[2]
• Klue revoked affected credentials and tokens, removed unauthorized code, disabled potentially affected integrations, notified law enforcement and brought in CrowdStrike.[1]