A four-year-old integration credential sat untouched in a competitive-intelligence platform. When attackers found it, they used the standing OAuth tokens to walk into the Salesforce environments of nearly 200 companies -- including some of the biggest names in cybersecurity.

What Happened

On June 12, 2025, an extortion group calling itself Icarus discovered a legacy credential inside Klue, a competitive-intelligence platform that sales and marketing teams connect to their CRM to track competitor activity. The credential had been issued in 2022 for a "limited pilot" and never revoked. Four years later, it still worked.

Using that single token, the attackers generated valid OAuth grants for every Klue customer that had linked their Salesforce instance. They then scripted bulk exports of contacts, support cases, and account records from each connected tenant. By the time Klue disclosed the intrusion on June 15, data from roughly 195 to 200 organizations had already been exfiltrated.

The victim list reads like a who's who of the security industry: LastPass, BeyondTrust, Snyk, Tanium, HackerOne, Recorded Future, Jamf, Huntress, Gong, OneTrust, Sprout Social, and Insurity all confirmed exposure. Several of these companies sell the very products designed to prevent this class of breach.

Anatomy of the Attack

The mechanics are almost mundane, which is exactly why the incident deserves attention. Icarus did not exploit a zero-day. They did not deploy custom malware. They found one old credential, used it as intended to request OAuth tokens for downstream Salesforce connections, and automated the data pull.

Klue's integration architecture is common across the SaaS ecosystem. Customers authenticate once, granting Klue an OAuth refresh token with broad read access to their Salesforce data. Klue stores those tokens to run scheduled syncs. When Klue's own systems were compromised, every stored token became a master key to the corresponding customer's CRM.

The exposed data was primarily business contact information -- names, emails, phone numbers, physical addresses, and support-case content. LastPass and BeyondTrust both confirmed that their core products (password vaults and privileged-access management) were not touched. But the distinction between "CRM data" and "product compromise" is cold comfort when your security vendor appears on a breach notification list.

Why This Keeps Happening: Fourth-Party Risk

The Klue breach is a textbook case of fourth-party risk -- the exposure that comes not from your vendor, but from your vendor's vendor. Every company on the victim list almost certainly ran a vendor-risk assessment on Klue before connecting it to Salesforce. None of those assessments caught a credential that was issued in 2022, scoped for a pilot, and simply forgotten.

This pattern is not new. Between August 9 and 17, 2025, a group tracked as UNC6395 stole OAuth tokens from Salesloft's Drift chatbot integration and used them to pull data from more than 700 Salesforce environments, including Cloudflare, Google, PagerDuty, Palo Alto Networks, Proofpoint, SpyCloud, and Zscaler. Tanium appears on both victim lists, hit once through Drift and once through Klue, ten months apart.

The common failure mode: a third-party app receives standing OAuth access to a core business system (Salesforce, in both cases), the credential ages without rotation or review, and a breach at the third party instantly becomes a breach at every downstream customer.

What Security Teams Should Do Now

The remediation steps are boring but effective. They require no new tooling budget, only operational discipline.

1. Inventory every third-party integration with API access to core systems. Start with Salesforce, then extend to GitHub, AWS, Google Cloud, and any other platform where a compromised token would be catastrophic. You cannot rotate what you do not know exists.

2. Time-box pilot and trial credentials. Any integration credential created for a proof-of-concept or limited pilot should carry a hard expiration date -- 90 days is a reasonable default. If the integration graduates to production, issue a new credential with a documented owner and review cycle.

3. Scope OAuth grants to the minimum necessary objects and fields. Klue's tokens had broad read access across the CRM. Most competitive-intelligence workflows only need a subset of objects (accounts, opportunities, maybe cases). Work with vendors to reduce scope, or use Salesforce's connected-app policies to enforce it.

4. Rotate on a schedule, not just on incident. Treat third-party OAuth tokens like employee passwords: rotate them annually at minimum, and immediately when a vendor discloses any security event. The 2025 Salesloft Drift breach should have triggered a rotation wave across every Drift customer. The Klue breach proves many organizations did not.

5. Monitor for anomalous bulk API activity. The Icarus extraction ran automated scripts that pulled data from hundreds of tenants in sequence. Salesforce's own event monitoring (or a SIEM fed by it) can flag unusual query volumes, especially from integration users that normally run on a predictable schedule.

The Ransomware Complication

Icarus followed a double-extortion playbook: exfiltrate, then threaten to publish unless paid. Klue reportedly reached an agreement to keep the data off the group's leak site, implying a payment was made. But paying did not contain the damage. A second, unrelated group is now reported to hold a portion of the same stolen dataset, meaning victims face potential extortion from multiple actors even after the initial negotiation.

This reinforces a hard lesson: once data leaves your environment, you lose control over how many copies exist and who holds them. Ransom payment buys silence from one party, not deletion of the data.

Industry and Regulatory Reaction

Because the exposed data was largely business contact and support-case information -- not financial records, health data, or authentication secrets -- the breach is unlikely to trigger the strictest U.S. state breach-notification thresholds on its own. But it arrives in a 2026 regulatory climate already sensitized by the Match Group breach (10 million records claimed by ShinyHunters), the Nintendo TinyPulse incident (859 MB stolen, $2 million ransom), the KDDI telecom breach (12.2 million users across six ISPs), and a wave of North Korean supply-chain attacks on npm packages targeting AI developers.

Cyber insurance underwriters are taking note. Renewal questionnaires increasingly ask specifically about third-party OAuth grant review cadence and credential age, not just whether a vendor-risk program exists on paper. The Klue breach gives underwriters a concrete case to cite when tightening those requirements.

Key Takeaways

• A single forgotten OAuth token from a 2022 pilot integration led to data exposure at nearly 200 companies, including major security vendors.
• Fourth-party risk -- your vendor's vendor -- is where supply-chain breaches increasingly originate. Point-in-time vendor assessments do not catch credentials that age into liability.
• Time-box all pilot credentials. Scope OAuth grants narrowly. Rotate on a calendar, not just on incident.
• Double extortion means paying a ransom does not guarantee the data stays private. A second group may already have a copy.
• The 2025 Salesloft Drift breach was a near-identical precursor. Organizations that only remediated Drift missed the systemic issue.

Frequently Asked Questions

What is Klue, and why did its breach affect so many other companies?

Klue is a competitive-intelligence platform that connects to customers' CRM systems, including Salesforce, via OAuth to pull competitor data. Because it held valid OAuth tokens for hundreds of customer integrations, a breach of Klue's systems gave attackers a path into each connected Salesforce tenant.

Which companies confirmed they were affected by the Klue data breach?

LastPass, BeyondTrust, Jamf, HackerOne, Recorded Future, Snyk, Tanium, Huntress, Gong, OneTrust, Sprout Social, and Insurity have all publicly confirmed impact. TechCrunch and SecurityWeek reporting puts the total number of exposed companies at 195 to 200.

Was LastPass's password vault compromised?

No. LastPass stated explicitly that its products, services, and infrastructure were not affected and that customer vaults remain secure. The exposed data was limited to business contact information and Salesforce CRM and support-case records.

Who is behind the Klue breach?

An extortion group calling itself Icarus claimed responsibility and reportedly reached an agreement with Klue not to publish the stolen data. A separate hacking group is also reported to hold a portion of the same dataset.

How does this compare to the 2025 Salesloft Drift breach?

Nearly identical mechanics: stolen OAuth tokens from a connected third-party app used to bulk-export Salesforce data. The Drift breach hit 700+ organizations (including Cloudflare, Google, PagerDuty, Palo Alto Networks). Tanium was a victim in both incidents.

What should engineering teams do to reduce fourth-party OAuth risk?

Maintain a live inventory of every third-party integration with API access to core systems. Enforce expiration dates on pilot credentials. Scope grants to minimum necessary access. Rotate tokens on a fixed schedule. Monitor for anomalous bulk API activity from integration users.

Conclusion

The Klue breach did not require a zero-day, a novel exploit, or sophisticated malware. It required one credential that should have been revoked in 2022. The same pattern -- dormant third-party OAuth tokens providing a bridge from a compromised vendor into core business systems -- has now played out at scale twice in ten months. The fix is not a new tool. It is operational hygiene: inventory, expire, scope, rotate, monitor. Until that hygiene becomes routine, the next Klue or Drift is only a matter of when, not if.

---

Sources: TechCrunch -- Klue hack results in data breach at several cybersecurity firms · SecurityWeek -- BeyondTrust, LastPass impacted by Klue Salesforce incident · Google Cloud Threat Intelligence -- Data theft from Salesforce instances via Salesloft Drift · SentinelOne 2026 Cybersecurity Statistics · BleepingComputer -- LastPass confirms data breach in Klue supply chain attack