[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$f1NDBGU2TBPnlwZUC-xFatREg9wbrurD9yAwXLAlvgz4":3},{"article":4,"iocs":52,"watch_terms":53,"solutions":54,"lesson":162},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":31,"category":32,"article_tags":36},"b70131dd-ec52-4fe9-a87b-cc859edd09e6","More Cybersecurity Firms Disclose Impact From Klue Hack","more-cybersecurity-firms-disclose-impact-from-klue-hack-378b9f","HackerOne, Huntress, Jamf, OneTrust, Recorded Future, Snyk, and Tanium are among the affected Klue customers. The post More Cybersecurity Firms Disclose Impact From Klue Hack appeared first on SecurityWeek.","At least nine organizations, including cybersecurity firms HackerOne, Huntress, Jamf, OneTrust, Recorded Future, Snyk, and Tanium, disclosed impact from a June 11-12 supply chain attack on market intelligence platform Klue. Attackers used compromised legacy credentials to obtain OAuth tokens for Salesforce integrations, exfiltrating business data such as sales accounts, contact information, names, emails, and phone numbers from customer Salesforce instances. Threat actor Icarus claimed responsibility and posted the stolen data to its leak site, threatening publication by June 22 unless negotiations occur.","Klue supply chain attack via compromised Salesforce OAuth tokens affects nine cybersecurity firms.","https:\u002F\u002Fwww.securityweek.com\u002Fmore-cybersecurity-firms-disclose-impact-from-klue-hack\u002F","https:\u002F\u002Fwww.securityweek.com\u002Fwp-content\u002Fuploads\u002F2024\u002F12\u002Fblockchain-cryptocurrency-Solana.jpeg","2026-06-22T09:03:08+00:00","2026-06-22T10:00:12.482284+00:00",9,[17,20,22,25,27,29],{"name":18,"type":19},"Klue","product",{"name":21,"type":19},"Salesforce",{"name":23,"type":24},"HackerOne","vendor",{"name":26,"type":24},"Huntress",{"name":28,"type":24},"Recorded Future",{"name":30,"type":24},"Snyk","26b0b636-0e31-4db1-bffb-61bdf9f20a58",{"id":31,"icon":33,"name":34,"slug":35},null,"Supply Chain","supply-chain",[37,42,47],{"category":38},{"id":39,"icon":33,"name":40,"slug":41},"2c8f44d4-b56e-47cf-9677-04f22c9ee78d","Identity & Access","identity-access",{"category":43},{"id":44,"icon":33,"name":45,"slug":46},"2e06f76c-d5b9-4f54-9eef-4d3447b10730","Breaches","breaches",{"category":48},{"id":49,"icon":33,"name":50,"slug":51},"e7b231c8-5f79-4465-8d38-1ef13aea5a14","Threat Intelligence","threat-intelligence",[],[23,26,28],{"controls":55,"vendors":142},[56,84,113],{"slug":57,"name":58,"problem":59,"products":60},"privileged-access-management","Privileged access management (PAM)","Admin accounts stop being one stolen password away from control of everything.",[61,69,76],{"vendor_slug":62,"vendor_name":63,"vendor_logo":64,"product_slug":65,"product_name":66,"url":67,"description":68},"beyondtrust","BeyondTrust","\u002Fvendor-logos\u002Fbeyondtrust.png","password-safe","BeyondTrust Password Safe","https:\u002F\u002Fwww.beyondtrust.com\u002Fproducts\u002Fpassword-safe","Privileged password and session management.",{"vendor_slug":70,"vendor_name":71,"vendor_logo":72,"product_slug":57,"product_name":73,"url":74,"description":75},"threatlocker","ThreatLocker","\u002Fvendor-logos\u002Fthreatlocker.png","Privileged Access Management","https:\u002F\u002Fwww.threatlocker.com\u002Fcapabilities\u002Fprivileged-access-management","Gives elevated rights to specific applications only where needed, so users do not need local admin accounts.",{"vendor_slug":77,"vendor_name":78,"vendor_logo":79,"product_slug":80,"product_name":81,"url":82,"description":83},"wallix","WALLIX","\u002Fvendor-logos\u002Fwallix.png","wallix-pam","WALLIX PAM","https:\u002F\u002Fwww.wallix.com\u002Fproducts\u002Fprivileged-access-management-software\u002F","Privileged access management with session recording, for IT and OT environments.",{"slug":85,"name":86,"problem":87,"products":88},"identity-threat-detection","Identity threat detection and response (ITDR)","Attackers who log in with real, stolen credentials get noticed.",[89,97,105],{"vendor_slug":90,"vendor_name":91,"vendor_logo":92,"product_slug":93,"product_name":94,"url":95,"description":96},"microsoft","Microsoft","\u002Fvendor-logos\u002Fmicrosoft.png","defender-for-identity","Microsoft Defender for Identity","https:\u002F\u002Fwww.microsoft.com\u002Fen-us\u002Fsecurity\u002Fbusiness\u002Fsiem-and-xdr\u002Fmicrosoft-defender-for-identity","Detects attacks against on-premises Active Directory and hybrid identities.",{"vendor_slug":98,"vendor_name":99,"vendor_logo":100,"product_slug":101,"product_name":102,"url":103,"description":104},"acalvio","Acalvio","\u002Fvendor-logos\u002Facalvio.png","shadowplex-identity-protection","ShadowPlex Identity Protection","https:\u002F\u002Fwww.acalvio.com\u002Fproducts\u002Fidentity-protection\u002F","Decoy accounts and credentials that expose identity attacks and credential misuse early.",{"vendor_slug":106,"vendor_name":107,"vendor_logo":108,"product_slug":109,"product_name":110,"url":111,"description":112},"okta","Okta","\u002Fvendor-logos\u002Fokta.png","identity-threat-protection","Okta Identity Threat Protection","https:\u002F\u002Fwww.okta.com\u002Fproducts\u002Fidentity-threat-protection\u002F","Continuous risk assessment of sessions after login, with automatic actions such as ending sessions.",{"slug":114,"name":115,"problem":116,"products":117},"third-party-risk-management","Third-party risk management (TPRM)","You know which suppliers could hurt you, and you hear quickly when one of them is breached.",[118,126,134],{"vendor_slug":119,"vendor_name":120,"vendor_logo":121,"product_slug":122,"product_name":123,"url":124,"description":125},"bitsight","Bitsight","\u002Fvendor-logos\u002Fbitsight.png","bitsight-tprm","Bitsight Third-Party Risk Management","https:\u002F\u002Fwww.bitsight.com\u002Fproducts\u002Fthird-party-risk-management","Supplier assessments and continuous monitoring based on security ratings.",{"vendor_slug":127,"vendor_name":128,"vendor_logo":129,"product_slug":130,"product_name":131,"url":132,"description":133},"upguard","UpGuard","\u002Fvendor-logos\u002Fupguard.png","upguard-vendor-risk","UpGuard Vendor Risk","https:\u002F\u002Fwww.upguard.com\u002Fproduct\u002Fvendor-risk","Supplier security questionnaires, ratings and continuous monitoring.",{"vendor_slug":135,"vendor_name":136,"vendor_logo":137,"product_slug":138,"product_name":139,"url":140,"description":141},"onetrust","OneTrust","\u002Fvendor-logos\u002Fonetrust.png","third-party-management","OneTrust Third-Party Management","https:\u002F\u002Fwww.onetrust.com\u002Fsolutions\u002Fthird-party-management\u002F","Supplier inventory, risk assessments and monitoring across privacy and security.",[143,148,152,154,158],{"slug":144,"name":23,"logo_path":145,"roles":146},"hackerone","\u002Fvendor-logos\u002Fhackerone.png",[147],"affected",{"slug":149,"name":26,"logo_path":150,"roles":151},"huntress","\u002Fvendor-logos\u002Fhuntress.png",[147],{"slug":135,"name":136,"logo_path":137,"roles":153},[147],{"slug":155,"name":28,"logo_path":156,"roles":157},"recorded-future","\u002Fvendor-logos\u002Frecorded-future.png",[147],{"slug":159,"name":30,"logo_path":160,"roles":161},"snyk","\u002Fvendor-logos\u002Fsnyk.png",[147],{"slug":163,"title":164,"body":165,"framework_refs":166,"framework_notes":178},"legacy-credentials-enable-supply-chain-attack-across-nine-cybersecurity-firms","Legacy Credentials Enable Supply Chain Attack Across Nine Cybersecurity Firms","Attackers exploited compromised legacy credentials at Klue to obtain OAuth tokens, pivoting into customer Salesforce integrations and exfiltrating sensitive business data across at least nine organizations — including several prominent cybersecurity firms. The root failure was the retention of stale, unrotated credentials that provided an illegitimate pathway to high-value downstream systems. This incident underscores the cascading risk of third-party integrations: a single vendor's credential hygiene failure can expose an entire ecosystem of customers. The irony that cybersecurity-focused organizations were among the victims highlights that even security-mature companies must rigorously vet and monitor their supply chain partners.",[167,168,169,170,171,172,173,174,175,176,177],"CIS Control 4: Secure Configuration of Enterprise Assets and Software","CIS Control 5: Account Management","CIS Control 15: Service Provider Management","NIST SP 800-53 AC-2: Account Management","NIST SP 800-53 AC-17: Remote Access","NIST SP 800-53 SA-9: External System Services","NIST SP 800-53 IA-5: Authenticator Management","NIST CSF ID.SC-4: Supply Chain Risk Management","GDPR Article 32: Security of Processing","GDPR Article 28: Processor Obligations","ISO 27001 A.15.1: Information Security in Supplier Relationships",{}]