The Hackers Got Hacked: Inside the Klue Breach and What It Means for Every Business Using Cloud Software

Key points

• Criminals from a group called Icarus broke into Klue, a Canadian software company serving more than 500 business customers, by using an old forgotten login credential from a pilot project that had never been switched off.
• The attackers harvested OAuth tokens, which are digital passes that let one piece of software speak to another on your behalf, and used them to pull customer data from Salesforce.
• A second criminal group then reportedly broke into Icarus and took the already-stolen data, turning the victims into a twice-removed target.
• The root cause was governance, not sophistication: a dormant service account sitting alive in production years after anyone needed it.
• Paying a ransom cannot guarantee data stays private when the criminals holding it may themselves be hacked.

Klue is not a household name. Founded in Vancouver in 2015 and backed by roughly 81 million dollars in venture funding, it makes software that helps sales and marketing teams keep tabs on competitors. More than 500 companies use it. To do its job, Klue plugs into the tools those companies already run: Salesforce, HubSpot, Slack, Google Drive, Gong, SharePoint, Zoom and Chorus, among others.

That access is the whole point of the product. It's also how this breach became everyone's problem.

How did the attackers get in?

A criminal group called Icarus found a service account, which is a kind of automated login created so one piece of software can talk to another, that had been set up for an old pilot project and never deactivated. Nobody was using it. Still open.

From there, Icarus didn't bother cracking passwords. They harvested OAuth tokens. Think of an OAuth token as a signed permission slip: it tells Salesforce or Slack that Klue is allowed to read your data, without asking for your password every time. Once Icarus held those tokens, they effectively wore Klue's identity inside customer systems.

They ran roughly 1,000 queries in fifteen minutes against at least one customer environment in Salesforce, pulling contact records, pricing data, sales quotes and deal communications. One forgotten credential cascading into a supply-chain event touching hundreds of downstream organisations is the failure mode our 14 July report on the ShinyHunters Salesforce campaign described in a different context: trusted app connections doing the attacker's lifting, no platform bug required.

Did a second gang really steal the stolen data?

Yes, reportedly. Icarus told Klue that another criminal group had broken into Icarus's own servers and taken a sample of the already-stolen files. That second group then apparently tried to extort the original victims directly while also telling those victims not to trust Icarus.

CSO Online, which detailed the incident, calls this strategically important. Stolen data doesn't sit locked in one place once criminals take it. It circulates, gets resold, changes hands. The people holding it aren't always the people you're negotiating with.

The traditional calculation around paying a ransom assumes one criminal group controls the information. The Klue case blows that assumption apart before you ever open negotiations. If the original attackers themselves have poor operational security, victims may face repeated extortion campaigns even after paying.

What does this mean for ordinary customers?

If your company uses Klue, Salesforce data including contact details, deal notes and pricing records may have been exposed. Klue reportedly detected the intrusion quickly, revoked the stolen credentials and brought in incident-response specialists.

Because Klue had legitimate, trusted access to customer Salesforce environments, Klue's breach became each customer's breach too, without those customers doing anything wrong. We first covered this SaaS integration risk pattern on 17 July, where three separate incidents showed how misconfigured cloud apps leak records without anyone breaking down a door.

Practically: if you work somewhere that uses Klue or a similar competitive-intelligence tool, watch for unusual outreach from people who seem to know detailed information about your sales pipeline or pricing. Report anything odd to your security or IT team.

Every honest post-mortem in this category lands in the same place: an inactive credential stayed enabled years past its purpose, and nobody had a process to find it. Vendor risk questionnaires and compliance certifications won't catch that. Only continuous credential governance will, and most programmes aren't running it.