At least nine organizations have publicly acknowledged the impact of the supply chain attack on market intelligence platform Klue.
The incident occurred on June 11-12 and affected Klue’s integration with Salesforce, resulting in data being exfiltrated from the Salesforce instances of multiple Klue customers, including several cybersecurity firms.
On Friday, Klue confirmed previous security reports that the attackers used compromised legacy credentials to access its systems and compromise Salesforce integrations.
“The attacker used that access to obtain OAuth tokens used to connect Klue with certain third-party platforms, including Salesforce, and subsequently accessed data within a number of connected customer environments,” Klue said.
The company revoked the affected credentials and tokens, disabled the integrations across multiple services, and has been investigating the attack together with CrowdStrike and law enforcement.
“Based on our investigation to date, the incident was limited to the affected third-party platforms, and there is no evidence that customer content stored within the Klue platform was impacted,” the company said.
To date, at least nine Klue customers have disclosed impact from the incident, including cybersecurity firms HackerOne, Huntress, Jamf, OneTrust, Recorded Future, Snyk, and Tanium. Insurity and Sprout Social also notified their customers of the incident.
All the affected companies pointed out that the intrusion was limited to the Salesforce instances and did not involve their systems, as Klue said in its incident notice.
Across the board, the hackers stole business information from the affected organizations’ Salesforce CRMs, including sales account data and business contact information, such as names, email addresses, job titles, phone numbers, and business addresses.
Salesforce disabled the Klue integration in the wake of the incident, and revenue intelligence platform Gong did the same on Friday, warning that the hackers exploited its Klue integration to access internal licensed user data.
“We can confirm no direct impact on call recordings or customer transcripts. Examples of data accessed included user names, user business titles, and user emails,” Gong said.
In its analysis of the incident, Huntress suggested that a threat actor named Icarus might have been responsible for the attack.
Since then, Icarus has added Klue to its Tor-based leak site, claiming responsibility for the attack and threatening to publish the information stolen from Klue customers’ Salesforce instances.
Per the threat actor’s posts, the data would be released on June 22, unless Klue and the affected organizations engage in negotiations.
Related: Cybersecurity Firms Impacted by Klue Supply Chain Attack
Related: Atomic Arch Supply Chain Attack Hits 1,500 AUR Packages
Related: ‘SymJack’ Attack Turns AI Coding Agents Into Supply Chain Attack Delivery Systems
Related: Laravel-Lang Packages Poisoned for Malware Delivery
