More Cybersecurity Firms Disclose Impact From Klue Hack
Klue supply chain attack via compromised Salesforce OAuth tokens affects nine cybersecurity firms.
At least nine organizations, including cybersecurity firms HackerOne, Huntress, Jamf, OneTrust, Recorded Future, Snyk, and Tanium, disclosed impact from a June 11-12 supply chain attack on market intelligence platform Klue. Attackers used compromised legacy credentials to obtain OAuth tokens for Salesforce integrations, exfiltrating business data such as sales accounts, contact information, names, emails, and phone numbers from customer Salesforce instances. Threat actor Icarus claimed responsibility and posted the stolen data to its leak site, threatening publication by June 22 unless negotiations occur.
AI summary of the linked source. Not reviewed by an editor. How this works
Run HackerOne?
Get an email when a new story names HackerOne, usually within the hour.
Free. Your list stays private and never appears in a subject line. One click stops it. How Vendor Watch worksPrivacy
The lesson from this incident
Full lessonAttackers exploited compromised legacy credentials at Klue to obtain OAuth tokens, pivoting into customer Salesforce integrations and exfiltrating sensitive business data across at least nine organizations — including several prominent cybersecurity firms. The root failure was the retention of stale, unrotated credentials that provided an illegitimate pathway to high-value downstream systems. This incident underscores the cascading risk of third-party integrations: a single vendor's credential hygiene failure can expose an entire ecosystem of customers. The irony that cybersecurity-focused organizations were among the victims highlights that even security-mature companies must rigorously vet and monitor their supply chain partners.
What helps against this
How we list vendors
- Privileged access management (PAM)
Admin accounts stop being one stolen password away from control of everything.
- Identity threat detection and response (ITDR)
Attackers who log in with real, stolen credentials get noticed.
- Third-party risk management (TPRM)
You know which suppliers could hurt you, and you hear quickly when one of them is breached.