About Two Dozen Klue Customers Confirm Salesforce Compromises
Summary
About two dozen Klue customers confirmed Salesforce-instance compromises after attackers used legacy credentials to obtain OAuth tokens and exfiltrate data. Salesforce and Gong disabled integrations; reports of data deletion and a second extortion actor remain ununfirm.
Key points
- The attack took place June 11–12. Attackers used compromised legacy credentials to access Klue and obtain OAuth tokens for customer integrations.
- Roughly two dozen customers confirmed their Salesforce instances were compromised; named organizations include AlertMedia, Blackbaud, Camunda, Cresta, Deel, Lucanet, Link11 and Tines.
- Attackers exfiltrated data in bulk, mainly business contact and support information.
- Salesforce disabled the Klue integration on June 17, and Gong also disabled it. Salesforce’s status page still showed the integration disabled at the time of reporting.
- Icarus claimed the attack and threatened to leak stolen information unless a ransom was paid.
- Klue reportedly told customers that the threat actor had begun deleting stolen data. A separate claim that Icarus was hacked and another actor obtained sample data remains unconfirmed.
Article Details
- Victim Organization
- Klue
- Incident Type
- Supply chain attack involving compromised legacy credentials and OAuth tokens for customer integrations.
- Data Types Exposed
- Business contact data
- Support data
- Affected Records
- The incident was reported to affect 195 Klue customers; the number of individual records was not disclosed.
- Operational Impact
- Salesforce disabled the Klue integration on June 17, and Gong also disabled it. The article says the Salesforce integration had not been re-enabled at the time of reporting.
- Ransom Or Extortion
- Icarus threatened to leak stolen information unless a ransom was paid. The article suggests Klue might have paid, but does not confirm payment. Klue reportedly told customers that another threat actor later obtained the data and was running a separate extortion campaign; the second group supposedly stole only sample data from Icarus.
- Claim Status
- confirmed
MITRE ATT&CK
Threat Actors
Vendors
KlueRoughly two dozen Klue customers have come forward and confirmed that their Salesforce instances were compromised in a supply chain attack earlier this month.SalesforceRoughly two dozen Klue customers have come forward and confirmed that their Salesforce instances were compromised in a supply chain attack earlier this month.
Products
GongGong also disabled the integration.KlueRoughly two dozen Klue customers have come forward and confirmed that their Salesforce instances were compromised in a supply chain attack earlier this month.SalesforceRoughly two dozen Klue customers have come forward and confirmed that their Salesforce instances were compromised in a supply chain attack earlier this month.