jason smith

LastPass customer data exposed through Klue supply chain attack LastPass disclosed that attackers used OAuth tokens compromised in a supply chain attack on Klue, a market intelligence platform that integrates with CRM and sales tools across organizations, to access customer data stored in its Salesforce environment. “On June 12th LastPass was made aware of an incident that occurred at Klue (klue.com), a third-party market intelligence platform utilized by our go-to-market teams which integrates with our Salesforce and Gong systems,“ LastPass said. “We immediately launched an investigation and learned that, as part of this incident, an unauthorized actor was able to obtain OAuth tokens Klue held for many of its customers, including LastPass.“ The company said the incident was limited to systems integrated with Klue’s platform and did not affect its products, services, infrastructure, or customer vaults. According to LastPass, the exposed data included standard business contact information and CRM records, including customer names, phone numbers, email addresses, physical addresses, support case information, and sales-related records. LastPass warned that the exposed contact details could be used in phishing or social engineering attacks and urged customers to be wary of unsolicited emails, phone calls, or requests for sensitive information, adding that it will never ask users for their master passwords. After discovering the breach, LastPass revoked employee access to Klue, rotated the exposed API tokens, and launched an investigation with Klue and Salesforce. The company also notified law enforcement and released indicators of compromise, including IP addresses and email sender domains. LastPass previously suffered a major breach in 2022, when attackers stole customer password vault backups. Three years later, researchers at TRM Labs linked cryptocurrency thefts to credentials recovered from some of the stolen vaults, with on-chain evidence pointing to possible Russian-speaking threat actor involvement. Klue breach triggers security vendor disclosures Last week, cybersecurity vendor Huntress acknowledged that it was among multiple companies affected by a breach originating at Klue. Huntress published a detailed account of the incident on June 18, describing it as a “security domino effect” that began with a compromised integration credential and led to the theft of customer data from several connected platforms, including Salesforce. Several other security vendors, including Recorded Future, Tanium, and Jamf, have also disclosed their involvement and published statements detailing how they were affected. An extortion group known as “Icarus,” active since late April 2026, claimed responsibility for the attack on its data leak site. “Based on our investigation to date, the incident was limited to the affected third-party platforms, and there is no evidence that customer content stored within the Klue platform was impacted,” Klue CEO Jason Smith noted. “We recognize that customers rely on Klue to securely connect to their systems, and we understand the seriousness of that responsibility.” “Since identifying the incident, we have been communicating directly with affected customers, sharing investigative findings and supporting their response efforts. Specific remediation guidance has been shared directly with affected customers,” Smith concluded. According to Klue, the incident was traced to a credential created for a limited pilot project in 2022 that was later used by attackers to access customer data. “The threat actor will likely continue to post the data of the companies that it compromised from the Klue breach. Icarus will also likely continue to put pressure on impacted organizations to pay a ransom in exchange for not releasing their data,” Huntress stated. Klue did not say whether it had been in contact with the hackers or planned to negotiate with them.

L’attacco non avrebbe colpito direttamente l’infrastruttura del password manager, ma un partner tecnologico, la società Klue. Esposti nomi, email, numeri di telefono, indirizzi fisici e dati legati ai casi di supporto. LastPass vittima di nuova violazione di dati. Il produttore del password manager ha comunicato che informazioni personali e record relativi ai casi di assistenza clienti sono stati rubati durante un recente attacco informatico a uno dei suoi partner tecnologici. Secondo un’email inviata a un cliente colpito e condivisa con TechCrunch, la violazione è avvenuta presso Klue, società di market research, e non nei sistemi interni di LastPass. Gli hacker, però, avrebbero sfruttato l’accesso ottenuto per sottrarre una grande quantità di dati relativi ai clienti LastPass. La società è l’ultima di una lista crescente di aziende di cybersecurity coinvolte nel breach di Klue, reso noto la scorsa settimana. Tra le altre realtà colpite figurano HackerOne, Recorded Future e Tanium. I dati rubati In un post pubblicato sul proprio blog, LastPass ha spiegato che i criminal hacker hanno sottratto nomi, numeri di telefono, indirizzi email e indirizzi fisici dei clienti. Sono stati inoltre compromessi dati relativi ai casi di assistenza clienti e informazioni legate alle attività commerciali e di vendita. LastPass ha precisato che la propria infrastruttura non è stata colpita. Secondo l’azienda, anche i password vault dei clienti non risultano coinvolti nell’incidente. Il nodo dei ticket di assistenza Resta però da chiarire il contenuto effettivo dei ticket di supporto sottratti. Questi dati possono contenere frammenti di informazioni private o sensibili, perché i clienti contattano di solito l’assistenza per problemi di fatturazione, accesso agli account o gestione dei servizi. In precedenti incidenti che hanno coinvolto ticket di assistenza clienti, tra i dati esposti sono comparsi anche credenziali e documenti d’identità rilasciati da autorità pubbliche. Al momento non è noto quanti clienti LastPass siano stati coinvolti. I portavoce della società non hanno risposto immediatamente alle richieste di commento di TechCrunch, incluse le domande sul numero degli utenti interessati. LastPass dichiara sul proprio sito di avere oltre 33 milioni di utenti e circa 1,6 milioni di clienti paganti al 2024. Il precedente del 2022 Il nuovo incidente arriva dopo il grave data breach subito da LastPass nel 2022. In quell’occasione, gli hacker riuscirono a sottrarre l’intero archivio dei password vault dei clienti, utilizzati per conservare credenziali sensibili come password, token, dati personali e numeri di carte di credito. I vault erano cifrati con master password conosciute solo dai clienti. Tuttavia, la violazione permise agli aggressori di tentare attacchi brute force offline sui vault protetti da master password deboli, con la possibilità di accedere ai segreti contenuti al loro interno. Diversi furti di criptovalute furono successivamente collegati al breach di LastPass, dopo il sospetto che gli hacker avessero sottratto chiavi di wallet craccando i vault delle vittime. L’attacco a Klue e il gruppo Icarus Il CEO di Klue, Jason Smith, ha dichiarato in un post che l’azienda ha identificato la presenza degli hacker nei propri sistemi il 12 giugno. A rivendicare l’attacco è stato Icarus, un gruppo specializzato in hacking ed estorsione, che ha minacciato pubblicamente di diffondere i dati rubati se non verrà pagato un riscatto.

Several companies have disclosed that they were affected by a breach of business intelligence provider Klue, including a number of cybersecurity firms. Huntress, Recorded Future, Jamf and Tanium have all acknowledged using Klue’s intelligence services and confirmed that the breach enabled unauthorized access to their Salesforce accounts via stolen OAuth tokens used for Klue integrations. Klue Battlecards Breach and Salesforce OAuth Token Abuse According to an official statement published by Klue’s CEO, Jason Smith, on June 19, the company detected an intrusion on June 12. An unauthorized actor gained access to Klue’s integration infrastructure, notably the Klue Battlecards app, through a compromised legacy credential. They used this access to obtain OAuth tokens - a secure digital key that allows an application to access a firm’s data on another service without needing a password – and connect Klue to third-party platforms, including Salesforce. They then accessed Klue customer data and leveraged the stolen OAuth tokens to impersonate Klue within those connected Salesforce environments, exfiltrating sensitive customer information before the activity was detected and contained. Klue’s Smith said the company immediately responded by revoking affected credentials and tokens, removing unauthorized code and disabling potentially impacted integrations. Klue also notified law enforcement and launched an internal investigation and comprehensive review of its security controls. It has now engaged CrowdStrike to support with forensics. Customers have been regularly updated about what happened and provided with remediation guidance through various channels. Salesforce also notified the public on June 17 it has disabled Klue Battlecards integration. Klue Breach Affects Cybersecurity Firms In customer-facing blog posts, Huntress, Recorded Future, Jamf and Tanium confirmed that while the breach originated through Klue’s infrastructure, their own products and services remained unaffected. Tanium reassured customers that "there was no impact on our ability to serve them." Meanwhile Jamf stated, "We have no evidence of lateral movement and have contained the incident on our end." However, Huntress warned that customer data may have been compromised, including business names, products trialed/used, subscription details, business contact information and marketing and sales communications. Jamf also warned customers about potential phishing campaigns leveraging the stolen Salesforce data, advising vigilance against malicious actors posing as Jamf employees. Recorded Future disabled Klue’s integration and conducted a forensic analysis, emphasizing the need for continuous monitoring of third-party integrations. The company said, "This incident underscores the critical need for continuous monitoring of third-party integrations, especially those with privileged access to sensitive data." ReliaQuest was the first to detect the suspicious and alerted Klue. However, the company told Infosecurity that it does not use Klue and was not affected by the breach. Commenting on how the attackers exploited OAuth tokens to pivot into connected Salesforce environments, the firm said: "The adversary’s ability to move laterally from a compromised integration to a customer’s CRM demonstrates the evolving tactics of modern threat actors.” Non-cybersecurity firms were also affected, including insurance service provider Insurity and social media analytics platform Sprout Social. The breach was claimed on June 19 by Icarus, a recently identified cyber extortion group. Icarus has just three victims listed on its data leak site, according to ransomware tracking website Ransomware.live. On June 20, the group issued a deadline message to all Klue clients it claims to have contacted, warning that they have until June 22 to respond before their data is released. This article was updated on June 22 to add ReliaQuest's comments, highlighting the company has not been affected by the Klue breach.

Market intelligence platform Klue has publicly confirmed a recent security incident that allowed threat actors to steal OAuth tokens used to connect to customers' Salesforce environments, as the new "Icarus" extortion group publicly claims the attack. The disclosure comes after cybersecurity firms Huntress and ReliaQuest detailed how attackers abused compromised Klue Battlecards integrations to steal Salesforce CRM data from multiple organizations. In a statement published this week, Klue CEO Jason Smith confirmed that the company discovered unauthorized activity on June 12 affecting part of Klue's integration infrastructure. "On June 12, we identified unauthorized activity affecting a portion of Klue's integration infrastructure. Since then, we've been working alongside trusted cybersecurity experts to understand what happened, support our customers, and restore the connections you rely on," wrote Smith. "Our investigation determined that an attacker gained access through a compromised legacy credential associated with an integration service. The attacker used that access to obtain OAuth tokens used to connect Klue with certain third-party platforms, including Salesforce, and subsequently accessed data within a number of connected customer environments." The company says there is currently no evidence that customer content stored directly within the Klue platform was impacted and that the incident was limited to third-party integrations. Klue says it immediately revoked affected credentials and tokens, removed unauthorized code, disabled impacted integrations, launched an investigation, and notified law enforcement. The company also confirmed it engaged CrowdStrike to assist with the response. ReliaQuest and Huntress found that the attackers used stolen OAuth credentials associated with Klue integrations to access customer Salesforce environments and conduct large-scale data theft. ReliaQuest observed attackers generating OAuth tokens and using Python scripts to query Salesforce's API for extended periods, as data was stolen. Huntress later disclosed that its own Salesforce environment was affected by the Klue breach and that the stolen data included business contacts, sales communications, pricing information, and other records. Icarus claims responsibility While BleepingComputer and Huntress previously linked the incident to the Icarus extortion operation, the threat actors have now publicly claimed responsibility on their data leak site. "As you've probably already heard, Klue.com has been impacted by us recently. A number of other companies' Salesforce instances, which were partners to Klue, were exfiltrated," reads the Icarus post. The threat actors went on to pressure Klue and affected organizations to contact them through the Session messaging platform to prevent the leaking of stolen data. The post comes after BleepingComputer previously reported that the attacks were linked to Icarus, after sources shared extortion emails sent to affected organizations. Huntress also independently connected the operation to Icarus through Session Messenger IDs used in the extortion emails and the group's data leak site. Since then, additional victims have disclosed that they were affected by the attacks, including Recorded Future, Tanium, Jamf, Sprout Social, Gong, and Insurity. Almost all say the incident led to the theft of data from their Salesforce instances and did not affect their platforms, infrastructure, payment information, or internal systems. Several organizations warned that the stolen business contact information could be used in follow-on phishing, social engineering, and extortion campaigns and urged customers to be vigilant. Overall prevention scores can hide what happens after initial access. Once attackers are using valid credentials, prevention drops sharply. The Blue Report 2026 measures defenses technique by technique across 338 million simulations run in customer production environments. Get the report

Klue breach lead to Salesforce data theft, Huntress affected Cybersecurity vendor Huntress was among multiple companies hit by a breach originating at Klue, a market intelligence platform used to integrate CRM and sales data across various business tools. Huntress published a detailed account of the incident on June 18, framing it as a “security domino effect” that began with one compromised integration credential and cascaded into theft of customer data across several connected platforms, including Salesforce. Attack timeline According to Huntress’s writeup, the attackers first gained access to Klue’s backend infrastructure on June 11 using a long-dormant API credential originally created for an abandoned third-party integration prototype. From there, they pushed a malicious code update designed to harvest OAuth tokens that Klue’s customers used to connect the platform to services including Salesforce, HubSpot, SharePoint, Zoom, Gong, Chorus, Clari, Google Drive, and Slack. Those stolen tokens were then used to query customer CRM systems directly and exfiltrate data. “Klue staff disabled the remote access and removed the token-theft code from their servers, and issued a general alert to customers on June 13, which did not indicate which customers were impacted,” Huntress stated. “But on June 16, emails began to appear in the inboxes of some Huntress staff with the subject line ‘top secret email’ and a warning: ‘Your data has been downloaded…You have 48 hours to communicate with us.'” Extortion email received by Huntress (Source: Huntress) Huntress attributes the attack to the extortion group calling itself “Icarus,” active since late April 2026, based on matching Session Messenger IDs found both in the extortion emails and on the group’s dark-web leak site. Huntress said the attackers made off with business contacts, price quotes, and other sales-related data and messaging, but not threat data, passwords, payment card information, or engineering data relating to the Huntress agent or telemetry. It also stressed that its products and infrastructure haven’t been affected. The company has shared indicators of compromise and recommended other Klue customers review logs, request access records from affected vendors, and consider revoking active sessions tied to the compromised integrations. Several security vendors, such as Recorded Future, Tanium, and Jamf, have also publicly stepped forward and released official statements on how they’ve been affected. Salesforce cuts off Klue app On Wednesday, Salesforce announced it had “disabled the connection between the Klue Battlecards app, installed by individual customers, and Salesforce”, after detecting unusual activity involving the app. “As a result, organizations will not be able to connect to Salesforce via this app until further notice,” the company said. On Thursday, Klue CEO Jason Smith said that since identifying unauthorized activity, they have revoked affected credentials and tokens, removed the unauthorized code pushed by the attackers, disabed potentially impacted integrations, and started an investigation. Law enforcement has been notified, he confirmed, and affected customers have been contacted and provided with information that should help with their own incident response. “Based on our investigation to date, the incident was limited to the affected third-party platforms, and there is no evidence that customer content stored within the Klue platform was impacted,” he added, and said that they are planning to further strengthen their security controls, credential management practices, monitoring capabilities, and deployment processes. The breach is part of a broader pattern of attackers targeting trusted third-party integrations rather than Salesforce itself: throughout 2025, a string of OAuth-abuse campaigns have hit other Salesforce-connected SaaS integrations, namely Drift and Gainsight. Update: June 19, 11:20 AM ET: The article was updated to note that several security vendors have also released official statements about this situation. Subscribe to our breaking news e-mail alert to never miss out on the latest breaches, vulnerabilities and cybersecurity threats. Subscribe here!

Salesforce has revealed that it disabled the Klue Battlecards app integration within its platform in response to a security incident impacting the competitive intelligence company on June 11, 2026. To that end, organizations will be unable to connect to Salesforce via the app until further notice, the American cloud-based software company noted in an alert published this week. "Salesforce took this action because our security teams recently detected unusual activity involving the app that may have resulted in unauthorized access to a subset of customer data via the app's connection to Salesforce," it noted. "This issue is limited to Klue's app connection and does not arise from a vulnerability within the Salesforce platform." The development comes as an extortion group dubbed Icarus compromised and exfiltrated data from customers of Klue, including cybersecurity company Huntress. "The data that was copied from our Salesforce account includes business contacts, price quotes, and other sales-related data and messaging," Huntress said. "No threat data, passwords, payment card information, or engineering data relating to the Huntress agent or telemetry we collect was affected." In its own update, Klue said it detected unauthorized activity affecting a portion of Klue's integration infrastructure on June 12, 2026, adding the attackers gained access through a compromised legacy credential associated with an integration service. "The attacker used that access to obtain OAuth tokens used to connect Klue with certain third-party platforms, including Salesforce, and subsequently accessed data within a number of connected customer environments," Klue CEO Jason Smith said. "Based on our investigation to date, the incident was limited to the affected third-party platforms, and there is no evidence that customer content stored within the Klue platform was impacted." Specifically, the intrusion is said to have allowed the threat actor to push a code update capable of collecting OAuth tokens that its customers use to connect Klue to their own systems. In response to the breach, Klue has taken steps to revoke affected credentials and tokens, remove unauthorized code, stop remote access, disable potentially impacted integrations, and launch a comprehensive investigation. As of June 16, 2026, some of Huntress employees have received an email with the subject line "top secret email" and a warning that states: "Your Salesforce data has been downloaded ... You have 48 hours to communicate with us. Do the right decision." "The threat actor seems to have leveraged a long-disused but still active credential to conduct the initial compromise – one that was originally created by Klue for them to prototype a third-party integration they later abandoned," the company said. "The threat actor then pivoted into Klue's infrastructure to steal the tokens used by Klue's customers, then used those stolen credentials to query those customers' CRM tools directly and, eventually, to exfiltrate the data." Not much is known about the Icarus actor other than the fact that they have been active since April 28, 2026, and have claimed a total of two victims to date. That said, the data theft campaign mirrors prior attack waves mounted by ShinyHunters and UNC6395. ReliaQuest, in its own analysis of the Klue integration abuse, said the activity shares similarities with the third-party OAuth-abuse playbook associated with the Salesloft Drift and Gainsight compromises that targeted Salesforce environments last year. "In the attacks we observed, the adversary first authenticated through a compromised Klue integration service account, generated OAuth tokens, and ran automated Python scripts (identifiable by Python-urllib user-agent strings)," ReliaQuest researchers Thassanai McCabe and Alexa Feminella said. "These scripts first enumerated the org's object catalog via GET /services/data/v59.0/sobjects, then looped REST API queries against the Salesforce query endpoint (/services/data/v59.0/query) and paginated results via the QueryMore cursor for almost 24 hours." These are assessed to be bulk data retrieval actions designed to pull large volumes of CRM records through the Salesforce REST API. This included a "concentrated burst" of nearly a thousand queries in 15 minutes against at least one environment and an extraction window that lasted more than six hours in another case. It's unclear how many Salesforce customers were affected by the latest attacks, although Klue said it has been communicating directly with impacted customers, sharing investigative findings, and assisting with their response efforts. "The common thread is the abuse of OAuth tokens or credentials from a trusted third-party vendor," ReliaQuest said. "These integrations are non-human identities with persistent, often broad access to sensitive data, yet they are typically monitored far less closely than employee accounts. That gap is why a 24-hour automated query loop could run from a 'trusted' integration account without tripping the usual alarms." Update The threat actor known as Icarus has officially listed Klue as one of their victims as of June 19, 2026. "This appears to confirm the attribution of who was behind the original attack, however," Huntress said. "As you've probably already heard, Klue.com has been impacted by us recently," according to a message posted on Icarus' leak site. "A number of other companies' Salesforce instances, which were partners to Klue, were exfiltrated." "We advice [sic] Klue to contact us for a swift resolution, in order not to affect the companies you work with. On the other note, if Klue doesn't want to accommodate this request, we advice [sic] the companies who want to protect their data to contact us via Session." In the aftermath of the incident, a number of security vendors and other firms have publicly confirmed they have been impacted - Jamf (Impact limited to business data fields within the Salesforce environment) Recorded Future (Impact limited to business data fields stored in our Salesforce database, such as client contact names and email addresses, along with certain business contract information) Tanium (Compromised information includes sales account data, such as opportunity names and values, and other sales-related messaging, as well as business contact information stored in Salesforce, such as names, job titles, and email addresses, and in some cases phone numbers, social media contact details, and business addresses) Gong (Compromised information includes internal licensed user data for a subset of customers, such as names, business titles, emails, but not call recordings or transcripts) Insurity (Impact limited to a very small set of active credentials, which have since been rotated) Sprout Social (Impact limited to business contact details, such as names, professional email addresses, phone numbers, job titles, and mailing addresses, along with organizational and account information, including company details, industry, and account-status information, and related commercial CRM records) OneTrust (Impact limited to third-party CRM-related data accessible through the Klue-Salesforce integration) HackerOne (Impact limited to business relationships and sales activity, including business contact information, such as email and phone numbers, and sales account and opportunity records) Snyk (Impact limited to business data fields within the Salesforce environments, including customer business contact information and only the title and description from a limited subset of customer support cases) LastPass (Impacted limited to standard business contact information and related CRM data, including customer names, phone numbers, email addresses, and physical addresses, as well as support case data and sales-related data) Pendo (Compromised information relates to business relationships and sales activity, including business contact information, non-sensitive deal and contract records, and limited non-proprietary business communications) 8x8 (Impact limited to fragmented contract and opportunity information, sales team notes, and contact information (names, business addresses, phone numbers, and email addresses of the customers) BeyondTrust (Impact limited to business contact and general sales-related customer information in its Salesforce CRM system) Huntress security researcher John Hammond told The Hacker News there are no indications at this stage that suggest any potential connections with past Salesforce-related attacks. "As far as we know, Icarus does not seem to be related or involved with the previous Salesforce incidents," Hammond said. "Their leak site states they have only been active since April 2026 and have only indicated two prior victims unrelated to past Salesforce campaigns." "SaaS supply chain breaches are accelerating," Obsidian Security said. "Threat actors have shifted from targeting individual organizations to targeting the SaaS vendors those organizations trust, because compromising one vendor means access to hundreds of enterprise environments at once." "When the attacker gained access to Klue's OAuth tokens, they didn't need a password, an MFA code, or a phished employee. They had the token. From Salesforce's perspective, that token is Klue. So access was granted and CRM records were queried at scale. Login activity did occur, but it came from infrastructure with no connection to Klue's legitimate environment." Icarus Publishes Stolen Data The threat actor behind the Klue compromise has listed data for Huntress and several other companies on its data leak site. In a statement shared with The Hacker News, Huntress confirmed that the 3.4 GB data posted is legitimate and limited to Salesforce CRM data. This includes - Contact information (e.g., full names, work emails, job title, phone number, and business addresses) Business names Products trialed/used Subscription details (units, pricing) Sales-related communications (such as price quotes, contacts, and tasks) with Huntress customers and partners, and Opportunity notes (i.e., free-form fields where teammates can capture and track thoughts and next steps) The data leak files were hosted on an IP address belonging to a Russian bulletproof hosting provider named PROSPERO. IP addresses associated with PROSPERO have been previously linked to exploitation efforts targeting Ivanti Endpoint Manager Mobile (EPMM). "In the coming weeks, impacted companies should watch for potential phishing campaigns that use compromised Salesforce-specific data," the managed security platform said. "Cybercriminals may pose as Klue or other victim vendors and use this data to try to collect further information about businesses." (The story was updated after publication on June 23, 2026, to reflect the latest developments.)