Klue Hack Leads to Data Breach Across Multiple Cybersecurity Companies

A June 2026 supply-chain attack against Klue’s integration infrastructure using a compromised legacy credential allowed attackers to push malicious code that harvested OAuth tokens and enabled large-scale Salesforce REST API exfiltration; at least nine organizations reported exposed CRM data (contact details, sales accounts, quotes, and communications) and the extortionist group Icarus publicly claimed responsibility and threatened to publish the stolen data.