Salesforce Disables Klue Integration After OAuth Token Theft Hits Customer Data

The Icarus extortion group exploited a legacy credential within the Klue Battlecards third-party integration to gain unauthorized access to bulk Salesforce customer data. This incident highlights the critical risk posed by stale or unrotated credentials in third-party integrations, which often operate with broad permissions and limited oversight. Data was exfiltrated over a 24-hour window before the breach was detected and contained, demonstrating gaps in real-time monitoring of OAuth token activity. Supply chain integrations frequently inherit excessive trust and access without commensurate security controls, making them attractive targets for attackers. Organizations must treat third-party API and OAuth relationships with the same rigor as internal privileged access.