Klue Security Review: OAuth Token Breach and Salesforce Data Risks
In short
Klue suffered a supply-chain OAuth token theft in June 2026 that exposed Salesforce CRM data for hundreds of organizations. The platform contained the incident within a day, with no access to its core customer content.
Klue security review focuses on the June 2026 supply-chain incident that allowed theft of OAuth tokens and subsequent exfiltration of customer Salesforce and CRM records. The platform detected the activity within 24 hours and engaged CrowdStrike for forensics. No evidence emerged of access to Klue-stored content, passwords, or payment data.
The June 2026 OAuth Token Incident
An attacker obtained access around June 11, 2026, through a long-dormant GitHub Personal Access Token issued in 2022 for an abandoned pilot integration. The token enabled injection of malicious code into Klue’s integration service, which harvested OAuth 2.0 tokens for connected platforms. Harvested tokens covered Salesforce, HubSpot, Gong, SharePoint, Zoom, Chorus, Clari, Google Drive, and Slack.
Klue identified unauthorized activity on June 12, the same day Salesforce notified the company. Automated Python scripts exfiltrated data via the Salesforce REST API for roughly 24 hours. Containment occurred the same day through token revocation, code removal, and integration disablement. Salesforce later disabled the Klue Battlecards connection around June 17. Klue published a public update on June 19, and CrowdStrike issued a forensic summary on July 1 confirming no further attacker activity.
Klue CEO Jason Smith stated the attacker used a compromised legacy credential to obtain tokens and access third-party environments only. The company notified law enforcement and committed to stronger controls including PKCE, refresh-token rotation, shorter sessions, IP allow-listing, and data minimization. Integrations remain limited while investigations continue.
Data Impact and Affected Organizations
Stolen tokens permitted direct queries to customer environments, posing as the legitimate Klue integration. Exfiltrated Salesforce records included business contacts with names, emails, phones, titles, and addresses, plus support cases, opportunities, quotes, sales notes, and business intelligence reports. Estimates place affected customer organizations between 195 and several hundred.
At least a dozen organizations publicly confirmed downstream exposure, among them LastPass, Huntress, Recorded Future, Tanium, Jamf, HackerOne, Snyk, OneTrust, Sprout Social, Pendo, and Insurity. Their own core products remained unaffected. The threat actor, self-identified as “Icarus,” conducted extortion through emails under the alias “mr bean” and a Tor leak site; some data later appeared listed or deleted. A second party later claimed involvement.
| Data Type | Exfiltrated via Salesforce | Klue Platform Content |
|---|---|---|
| Business contacts and CRM records | Yes | No |
| Sales notes and opportunities | Yes | No |
| Passwords and payment data | No | No |
| Core product infrastructure | No | No |
Customers should audit Salesforce query logs and connected app grants. The incident underscores risks from stale credentials and stored OAuth tokens in SaaS integrations. As of October 2026, no additional major developments have been reported beyond ongoing industry focus on non-human identity governance.
Klue Security Review and User Feedback
Pre-incident user reviews on G2, totaling roughly 443 to 448 entries, average 4.7 out of 5. Reviewers cite competitive insights, battlecards, Salesforce and Slack integrations, alerts, and support quality. Some mention a learning curve and ongoing maintenance effort. Post-incident discussions on forums center on supply-chain and OAuth visibility issues rather than broad distrust of the platform itself.
Klue, founded around 2015 with more than 500 customers and investment from Salesforce Ventures, provides a competitive intelligence platform for revenue and go-to-market teams. The June 2026 event marks the first widely reported major incident. Affected users continue to receive remediation support, and the company has published details on implemented security improvements.
Frequently asked questions
What happened in the Klue June 2026 incident?
An attacker used a dormant GitHub token to inject code that stole OAuth tokens for customer integrations. Data exfiltration from Salesforce occurred over about 24 hours before containment.
Was Klue platform data accessed?
Forensics found no evidence that attacker activity reached Klue-stored customer content, passwords, or payment information. Exposure remained limited to connected third-party environments.
How many organizations were affected?
Estimates range from 195 to several hundred customer organizations. At least a dozen have publicly confirmed downstream Salesforce data exposure.
What steps has Klue taken since the breach?
Klue revoked tokens, disabled integrations, engaged CrowdStrike, notified law enforcement, and committed to controls such as PKCE and refresh-token rotation.
Should users continue with Klue integrations?
Integrations remain limited pending further review. Customers are advised to audit their own Salesforce logs and connected grants while monitoring for follow-on risks.
TrustScope
Comments 10