Klue security breach: OAuth tokens used to access Salesforce, HubSpot and other CRM systems

The June 2026 Klue security breach allowed a threat actor to harvest OAuth 2.0 tokens from the competitive intelligence platform and use them to access customer data in Salesforce, HubSpot, Gong, and other connected systems. The incident did not involve direct compromise of data stored inside Klue itself. Organizations that had enabled the Klue integration faced exposure of contact records, sales opportunities, and competitive intelligence reports.

Klue OAuth Token Breach Timeline and Method

On or around June 11, 2026, the actor known as Icarus obtained access through a long-dormant 2022 GitHub personal access token tied to an abandoned pilot project. The credential allowed the attacker to push malicious code that extracted OAuth tokens for integrations with Salesforce, HubSpot, Gong, SharePoint, Zoom, Chorus, Clari, Google Drive, Slack, and additional services. Klue detected the activity on June 12 and issued a customer alert the following day.

Attackers authenticated as the Klue integration and ran automated scripts against CRM APIs, including Salesforce REST endpoints for objects and queries. They retrieved business contact information, support cases, opportunities, quotes, and related records. Salesforce disabled the Klue Battlecards app connection around June 17 after observing unusual query patterns. Klue revoked the tokens, removed the unauthorized code, and engaged CrowdStrike and law enforcement.

Klue stated that the attacker had used a compromised legacy service account credential to reach third-party environments only. No evidence emerged of access to content stored natively on the Klue platform. As of October 2026, many integrations remain disabled pending further review, and investigations continue into possible additional disclosures.

Scope of Access and Confirmed Impact

More than a dozen organizations publicly confirmed exposure, including LastPass, Huntress, Recorded Future, Tanium, Jamf, HackerOne, Snyk, OneTrust, Sprout Social, Gong, Insurity, BeyondTrust, 8x8, and Pendo. One extortion group claimed roughly 195 Klue customers were affected overall, though Klue has not released an official total. A second group later asserted it had obtained samples from the first actor and attempted separate extortion.

The stolen tokens enabled queries that returned structured CRM data without requiring direct login to the affected platforms. Icarus listed victims on a Tor leak site and sent extortion emails under the alias “mr bean,” publishing limited data samples. Klue reported contact with the initial actor, who claimed to delete data before the site went offline. Integrations with Salesforce and Gong stayed disabled through October 2026.

The event highlighted risks associated with long-lived credentials and stored OAuth tokens in SaaS supply chains. Similar patterns of OAuth abuse against Salesforce-connected applications have appeared in prior campaigns. Organizations are advised to audit Klue-related tokens, review API logs for unusual activity from the Python-urllib user agent, and revoke access where anomalies appear.

Practical Steps After the Klue OAuth Incident

Companies that connected Klue to their CRM environments should begin by listing all active OAuth tokens issued to the Klue integration and revoke those no longer required. Next, examine query logs in Salesforce and other connected platforms for the period between June 11 and June 17, 2026, focusing on requests to object and query endpoints. Any sessions showing the Python-urllib user agent or large-scale pagination warrant immediate investigation.

Security teams can cross-reference Klue’s official incident update with their own access records to determine whether specific records were retrieved. Where possible, rotate service accounts and enforce shorter token lifetimes for future integrations. Ongoing monitoring for misuse of the exfiltrated data remains necessary, given that some samples circulated among extortion groups.