Vancouver's Klue says stolen integration credential exposed customers' Salesforce data

Vancouver-based competitive intelligence company Klue says an attacker used a compromised legacy credential tied to one of its integration services to steal OAuth tokens and pull data from customers' Salesforce environments. Salesforce disabled Klue's Battlecards integration across its platform on June 19 while the incident was investigated.

The breach is a supply chain incident in miniature: a single Canadian software vendor became the route into the sales systems of dozens of other companies, including several security firms. It follows the same pattern as the 2025 Salesloft Drift and Gainsight compromises, in which tokens granted to a connected app were used to siphon CRM records.

What happened

Klue says it detected unauthorized activity in part of its integration infrastructure on June 12, 2026. According to chief executive Jason Smith, the attacker used the old credential to obtain OAuth tokens that connect Klue to certain third-party platforms, The Hacker News reported. The company says there is "no evidence that customer content stored within the Klue platform was impacted." TechCrunch traced the credential to a limited 2022 pilot, BetaKit reported.

Salesforce said its teams detected unusual activity involving the app and that the problem did not stem from a vulnerability in the Salesforce platform. Klue says it revoked credentials and tokens, removed unauthorized code, disabled potentially affected integrations, notified law enforcement and brought in CrowdStrike to investigate.

A previously little-known extortion group calling itself Icarus listed Klue on its leak site and threatened to publish the data unless paid. Companies that have disclosed impact include LastPass, Huntress, Recorded Future, Tanium, Jamf, OneTrust, Sprout Social, HackerOne and Snyk. Most describe the stolen material as business contact details, sales opportunities, contract information and support-case notes. Huntress said 3.4 GB of posted data was genuine and limited to Salesforce CRM records.

What we don't know yet

Klue has not said how many customers were affected. Klue has not publicly attributed the attack, and the Icarus claim has not been independently confirmed.

What to do

• Audit every third-party app connected to Salesforce and other SaaS platforms, and remove integrations and service accounts that are no longer used.
• Revoke and reissue OAuth tokens for integrations that may be affected, and limit each one to the minimum permissions it needs.
• Watch Salesforce API logs for bulk queries or access from unfamiliar infrastructure.
• Warn sales and support staff that stolen CRM data is often used for targeted phishing.