On June 12, 2026, a compromised legacy credential at market intelligence provider Klue allowed attackers to exfiltrate Salesforce customer relationship management data belonging to hundreds of its clients, exposing sensitive business information across a wide swath of the competitive intelligence sector, according to Cybersecurity Dive. Klue identified this unauthorized activity within its integration infrastructure, leading to the compromise of OAuth tokens used to connect customer environments, most notably Salesforce, according to Rescana.
Companies increasingly integrate third-party tools for enhanced functionality, but this reliance introduces profound supply chain vulnerabilities that can lead to mass data exfiltration from seemingly secure platforms. The Klue incident reveals how a single point of compromise in a third-party vendor can trigger a widespread data exfiltration event, impacting numerous downstream clients.
Based on the Klue breach, companies are likely underestimating the cascading security risks posed by their extended vendor ecosystem, necessitating a fundamental shift towards more stringent third-party access management and continuous monitoring.
Hundreds of Companies Exposed: What Data Was Stolen?
Attackers gained access to standard CRM data, including names, emails, physical addresses, phone numbers, and support-case data and sales-related information, LastPass stated, according to Cybersecurity Dive. This exfiltration also included business contact information such as names, email addresses, phone numbers, and job titles, as reported by TechCrunch. This trove of data paints a clear picture of potential exploitation, exposing hundreds of Klue's customers to significant risks, including targeted phishing, social engineering, and competitive intelligence theft.
How a Legacy Credential Unlocked Customer Data
The attacker used compromised access to obtain OAuth tokens, connecting Klue with third-party platforms like Salesforce, reported CSO Online. These tokens then granted attackers access to data within customer environments, particularly for Salesforce integrations. This attack, leveraging legacy credentials and OAuth tokens, reveals a sophisticated bypass of direct platform vulnerabilities, highlighting how a single compromised third-party credential can grant deep, persistent access to customer data across multiple client environments without needing to breach each client individually.
