Klue OAuth Breach 2026: How a Forgotten Integration Credential Exposed Customers’ Salesforce Data

On 11 June 2026, an attacker used an old GitHub personal access token to push unauthorised code into the integration service of Klue, a competitive intelligence platform. That code collected the OAuth access and refresh tokens Klue's customers had granted so the Klue Battlecards app could read their Salesforce data. With those tokens, the attacker queried customer Salesforce tenants directly, posing as the trusted integration, and exported contacts, opportunities, quotes and sales notes. Salesforce alerted Klue on 12 June, and an extortion group called Icarus claimed the attack. Confirmed victims include LastPass, Huntress, Recorded Future, Tanium, Jamf and several other security vendors. It is a textbook non-human identity failure: a credential from an abandoned pilot was never retired, and one vendor's stored tokens unlocked many customers' CRM systems.

At a glance

What happened

Klue's Battlecards app connects to customer systems such as Salesforce using OAuth tokens that customers grant and Klue stores in its integration service.

Klue's CrowdStrike investigation summary, published on 1 July 2026, sets out the core facts: "On June 11, 2026, a Threat Actor leveraged a previously compromised GitHub personal access token (PAT) to introduce unauthorized code into Klue's integration service and collect third-party integration credentials including OAuth access and refresh tokens for Salesforce."

The history of that credential is the heart of the case. Huntress, one of the victims, wrote that "the threat actor seems to have leveraged a long-disused but still active credential to conduct the initial compromise", one "originally created by Klue for them to prototype a third-party integration they later abandoned." Klue spokesperson Katie Berg told TechCrunch the credential "was originally provided to a third-party in 2022, for a limited pilot." Obsidian Security notes the token had highly privileged access, including the ability to change code.

With the harvested tokens, the attacker went straight to Salesforce's REST API. ReliaQuest, which detected the activity and alerted Klue, says the attacker first listed the available objects through the /services/data/v59.0/sobjects endpoint, then pulled data through /services/data/v59.0/query, using QueryMore pagination to page through large result sets. ReliaQuest saw almost 1,000 queries in 15 minutes in one environment and extraction lasting more than six hours in another. Huntress and Obsidian describe the same pattern, with Python-urllib user agents and a small set of IP addresses. Obsidian adds that before the incident the Klue app connected with a python-httpx user agent and v64.0 of the API, so the switch to python-urllib and v59.0 stood out from the integration's normal behaviour.

On 12 June, according to Klue's summary, "Salesforce notified Klue of suspected unauthorized third party activity originating from Klue's API integration service." That same morning Klue disabled the affected Google Kubernetes Engine pods, disabled the compromised GitHub tokens and rotated OAuth credentials. Huntress says Klue sent a general alert to customers on 13 June without saying which were affected, deactivated OAuth credentials for all customers and temporarily disabled its integrations with Salesforce, HubSpot, SharePoint, Zoom, Gong, Chorus, Clari, Google Drive and Slack. Infosecurity Magazine reports that Salesforce told the public on 17 June it had disabled the Klue Battlecards integration.

Extortion followed quickly. Huntress staff received extortion emails on 16 June, and Icarus listed Klue on its leak site on 19 June. Infosecurity Magazine reported that on 20 June the group told Klue clients they had until 22 June to respond before data was released, and Huntress says Icarus published data for Huntress and other companies on 22 June. On 25 June, Klue told customers that "Icarus told us they are taking steps to delete the data taken from Klue customers", according to TechCrunch, while a second group demanded payment and claimed 195 Klue customers were affected.

Timeline

How it happened: the identity attack path

1. A credential outlives its purpose. A token created for a 2022 pilot integration was never revoked when the work was abandoned. It kept its privileges, including write access to code.
2. Source code access becomes production access. Using the GitHub token, the attacker introduced unauthorised code into Klue's integration service, which ran with access to every customer OAuth grant it held.
3. Customer tokens harvested. The new code collected OAuth access and refresh tokens for Salesforce. Refresh tokens matter because they let the holder obtain new access tokens without the customer doing anything.
4. Impersonating a trusted app. The attacker called Salesforce as the Klue Battlecards connected app. No password, MFA prompt or phished employee was needed, because the app had already been authorised by each customer.
5. Reconnaissance, then bulk export. The attacker enumerated Salesforce objects, then ran automated queries with pagination to export accounts, contacts, opportunities, cases, tasks and quotes.
6. Detection by behaviour. The tokens were valid, so the signal was new IP addresses, a different user agent and API version, and a spike in query volume.

Impact

Klue says it has seen no evidence that customer content stored within the Klue platform was affected, and CrowdStrike found no evidence that the attacker accessed Klue systems beyond those related to the integration service, or any attacker activity in Klue's environment after 12 June.

The damage was in customers' own Salesforce tenants. Huntress says data copied from its Salesforce account included business contact details, business names, products trialled or used, subscription and pricing details, sales communications and opportunity notes. It says no threat data, passwords, payment card information or engineering data was affected, and that in Gong only internal employee information was accessed. By 25 June, TechCrunch listed eleven companies that had confirmed impact: Gong, Jamf, HackerOne, Huntress, Insurity, LastPass, OneTrust, Recorded Future, Snyk, Sprout Social and Tanium.

The total number of affected organisations is not confirmed. Klue has not published a figure. The second extortion group claimed 195 affected customers, and Huntress reported that another party claimed it would publish data on "nearly 200 companies". Obsidian Security, which analysed several victim tenants, reports the largest single theft at about 13.9 million records.

What this means for NHI governance

Klue is a chain of non-human identities from start to finish. A GitHub token opened the codebase, the integration service held customer OAuth grants, and those grants let an outsider act as a trusted app inside many Salesforce tenants. No human account was compromised, and every login the attacker used was technically valid.

The root cause was lifecycle, not cryptography. A credential issued for a short pilot in 2022 was still active four years later, with enough privilege to change production code. That is the orphaned-credential problem that most NHI programmes are built to find: nobody owned it, nobody used it, and nobody revoked it. It also shows that source code and CI/CD access tokens deserve to be treated as production credentials, a theme covered in our page on CI/CD pipeline exploitation.

For customers, the breach repeats the lesson of the Salesloft Drift breach a year earlier. When you authorise a SaaS vendor's app into your CRM, the vendor's security becomes part of yours, and its stored refresh tokens become standing access to your data. Detection worked because the malicious sessions looked different from the app's normal behaviour, which only helps if someone baselines connected apps.

Recommendations

• Inventory and review connected apps. List every third-party OAuth app in Salesforce and other core SaaS platforms, confirm an internal owner and business need, and remove anything unused. Our SaaS-to-SaaS and OAuth App Governance Guide covers how.
• Limit what integrations can reach. Grant the narrowest scopes and objects an app needs, and restrict integration users with IP allowlisting where the platform allows it, as ReliaQuest recommends.
• Retire credentials when projects end. Tie every token and service credential to an owner and an expiry date, and revoke them when a pilot, integration or supplier relationship closes, following the NHI Lifecycle Management Guide.
• Replace long-lived code access tokens. Klue disabled personal access tokens and added secret scanning after the incident. Prefer short-lived, scoped credentials for code and pipeline access, as described in the Secrets Management Guide.
• Baseline integration behaviour and alert on drift. Watch for new source IPs, user agents, API versions and sudden spikes in query volume from connected apps, and hunt for the published indicators.
• Revoke and rotate after a vendor incident. Revoke the supplier's OAuth grants and refresh tokens and review API logs for the exposure window.

Frequently asked questions

What happened in the Klue breach?

On 11 June 2026 an attacker used a stale GitHub personal access token to add code to Klue's integration service. The code stole customers' Salesforce OAuth tokens, which the attacker used to export CRM data from customer tenants before Salesforce alerted Klue on 12 June. The Icarus extortion group claimed the attack.

How many organisations were affected by the Klue breach?

Klue has not published a number. At least eleven companies had publicly confirmed impact by 25 June 2026, and a second extortion group claimed 195 Klue customers were affected. We found no reputable source supporting a figure of 700 or more.

Was Salesforce hacked in the Klue breach?

No. The attacker used valid OAuth tokens stolen from Klue to act as the Klue Battlecards app. Salesforce detected the suspicious activity, notified Klue and disabled the Klue Battlecards integration. The weak point was Klue's stale credential and its store of customer tokens.

Related NHI Mgmt Group resources

Salesloft Drift breach · Vercel Context.ai OAuth supply chain breach · ShinyHunters Salesforce data theft campaign · SaaS-to-SaaS and OAuth App Governance Guide · NHI breaches

How NHI Mgmt Group can help

The Klue breach turned one forgotten token and a store of customer OAuth grants into access to many companies' CRM data, which is exactly the kind of risk NHI governance exists to catch. Our NHI Foundation Level Training Course helps teams inventory, own and retire tokens, OAuth apps and integration credentials before attackers find them.

References

• Klue: An Update on the Recent Klue Security Incident (18 June 2026, updated 10 July 2026)
• Klue: CrowdStrike Investigation Summary and Security Improvements (1 July 2026)
• Huntress: Cybercrime Breaches Klue: Salesforce Data Impacted for Many Victims, including Huntress (18 June 2026, updated 24 June 2026)
• ReliaQuest: Klue Integration Abused in Salesforce Data Theft (17 June 2026, updated 22 June 2026)
• Obsidian Security: Technical Analysis of the Klue Attack: OAuth Abuse, Stale Integrations, and Salesforce Exfiltration (25 June 2026, updated 7 September 2026)
• Infosecurity Magazine: Klue Breach Enables Hackers to Compromise Cybersecurity Firms (22 June 2026)
• TechCrunch: Klue says hackers stole credential from 2022 that led to customer data breaches (23 June 2026)
• TechCrunch: Hacked Klue says criminals are deleting stolen customer data, but now other hackers are making threats (25 June 2026)