When a vendor's breach becomes yours: lessons from the Klue incident

A compromised, long-unused credential in market-intelligence SaaS provider Klue allowed an attacker to inject token-harvesting code, steal OAuth tokens, and access connected customers' Salesforce data across multiple organizations (including Snyk and other security vendors), resulting in data exfiltration and extortion attempts; the report emphasizes the risk of forgotten credentials and the cascading blast radius of downstream integrations.