Reported by 1 outlet

Timeline

1. original reporting

   Klue OAuth Breach — 9+ Cybersecurity Firms Disclose Impact, Icarus Sets Data Leak Deadline for Today

   securityweek.com · 114d ago · June 22nd, 2026

   The supply chain breach of market intelligence platform Klue continues to widen, with nine organizations now publicly acknowledging data theft from their Salesforce instances following the June 11–12 compromise of Klue's OAuth integrations. Cybersecurity firms HackerOne, Huntress, Jamf, OneTrust, Recorded Future, Snyk, and Tanium — plus Insurity and Sprout Social — have confirmed that attackers used compromised legacy credentials at Klue to steal OAuth tokens and query their Salesforce CRMs for business contact data.

   Klue CEO Jason Smith confirmed CrowdStrike and law enforcement involvement. Salesforce has disabled the Klue integration platform-wide, and Gong also disabled its Klue integration, warning that licensed user data (names, business titles, emails) was accessed — though Gong clarified no call recordings or transcripts were compromised.

   The Icarus extortion group has set June 22 as the data leak deadline on its Tor leak site, threatening to publish the stolen Salesforce data unless Klue and affected organizations negotiate. This story has been tracked since June 19 — today's delta is the expanded victim list and the active leak deadline.

   Hunting hypothesis: Revoke and rotate any OAuth tokens issued to Klue or similar third-party Salesforce integrations. Audit Salesforce API access logs for unexpected /services/data/ queries from IPs 138.226.246.94, 212.86.125.24, 213.111.148.90, 94.154.32.160.

   ---