Klue OAuth Supply-Chain Breach Exposed Salesforce Data Across Multiple Customers

Attackers breached market intelligence vendor Klue and used a compromised legacy credential tied to an old integration service to implant malicious code, harvest customer OAuth tokens, and access connected Salesforce environments through the Klue Battlecards app. Incident responders and affected companies said the attackers then used legitimate Salesforce REST API access to enumerate objects and exfiltrate CRM data over many hours, including business contacts, account records, quotes, sales communications, support case metadata, and related commercial information. Salesforce disabled the Klue app connection during the investigation and stressed the incident did not result from a vulnerability in the Salesforce platform itself, while Klue revoked credentials and tokens, disabled multiple integrations, engaged CrowdStrike, and notified law enforcement.

The campaign has been widely attributed to the Icarus extortion group, which allegedly sent ransom demands and threatened to leak stolen data, though some reporting noted tradecraft overlaps with ShinyHunters-style Salesforce OAuth abuse. Publicly disclosed victims grew from early reports involving Huntress, Recorded Future, Jamf, Tanium, Sprout Social, Gong, HackerOne, Snyk, OneTrust, and Insurity to later confirmations from LastPass, BeyondTrust, and others, with some reports putting the total affected customer count far higher. Most impacted organizations said the exposure was largely confined to CRM and business data in Salesforce or connected apps, with no evidence that core products, internal infrastructure, password vaults, payment data, or engineering systems were compromised.