Klue OAuth breach victim list grows as Icarus hackers claim attack

Klue disclosed unauthorized activity on June 12 after attackers abused Klue Battlecards integrations to steal OAuth tokens and exfiltrate Salesforce CRM data from multiple partner organizations; the extortion group Icarus has claimed the attack and posted demands, and security firms Huntress and ReliaQuest published analysis of the compromise.