The Klue Security Incident and Its Impact on Recorded Future

Recorded Future disclosed that a third-party marketing vendor, Klue, experienced unauthorized access beginning on June 12, 2026, which compromised an integration between Klue and Salesforce. The incident allowed access via a compromised OAuth token to certain Salesforce business data (client contact names, email addresses, and potentially some contract information). Recorded Future says the event was contained the same day, affected only the integration layer, there is no evidence of compromise of their core platform or internal systems, and they revoked tokens, engaged Salesforce, correlated malicious IPs, and continue to monitor and investigate.