Cyber Attack & Data Breach · huntress.com

Klue Breach Exposes Salesforce Data from Huntress and Other Customers

Jun 18, 2026 · Original article ↗

Summary

Attackers stole Klue customers’ OAuth tokens and used them to access connected systems. Huntress confirmed Salesforce business and sales data was exposed; it found no impact to products, infrastructure, passwords, or payment data.

Key points

Attackers exploited a long-disused but active credential to access Klue systems, added code to collect customer OAuth tokens, and used them to query connected services.
Huntress confirmed that Salesforce data—including business contacts, subscription details, sales communications, and opportunity notes—was accessed and later listed by Icarus.
Huntress said its products, infrastructure, telemetry, passwords, and payment-card data were not affected; its Gong exposure was limited to internal employee information.
Klue deactivated customer OAuth credentials and temporarily disabled integrations including Salesforce, HubSpot, SharePoint, Zoom, and Slack.
Huntress attributed the attack to Icarus based on matching Session IDs and other evidence; Icarus later posted data for Huntress and other companies.
Huntress advised potentially affected organizations to review service logs and email, request missing vendor logs, and consider revoking active sessions.
The stolen business and sales data could be used in targeted phishing; Huntress cautioned against downloading raw leak archives.

Article Details

Victim Organization: Huntress
Incident Type: Supply-chain breach through Klue: attackers stole OAuth tokens, used them to access customers' connected systems, and exfiltrated Salesforce data from Huntress.
Incident Date: 2026-06-11
Disclosure Date: 2026-06-18
Data Types Exposed: Business contact information, including names, work emails, job titles, phone numbers, and business addresses
Business names
Products trialed or used
Subscription details, including units and pricing
Sales-related communications, including price quotes, contacts, tasks, and conversational data
Opportunity notes
Competitive market reports
Internal Huntress employee information accessed in Gong
Operational Impact: Huntress confirmed that partner and customer data was obtained from Salesforce and internal employee information was accessed in Gong. Huntress reported no indication that its products, infrastructure, telemetry, passwords, payment-card data, or engineering data were affected. Data relating to Huntress was listed on Icarus's leak site on June 22, 2026.
Ransom Or Extortion: Icarus urged Klue and affected companies to contact it via Session and threatened disclosure of stolen data. Huntress received emails warning that its data had been downloaded and giving staff 48 hours to communicate. Huntress said Icarus would likely continue pressuring affected organizations to pay a ransom; no payment was reported. A separate party's later claim of access and planned disclosures remained unverified.
Claim Status: confirmed

Indicators of compromise

Type	Indicator	Context
DOMAIN	`baccarat[.]com[.]au`	Huntress reported that the domain's real mail server was abused as compromised infrastructure to send the threat actor's extortion emails.
DOMAIN	`house[.]com[.]au`	Huntress reported that the domain's real mail server was abused as compromised infrastructure to send the threat actor's extortion emails.
DOMAIN	`robinskitchen[.]com[.]au`	Huntress reported that the domain's real mail server was abused as compromised infrastructure to send the threat actor's extortion emails.
IPV4	`138[.]226[.]246[.]94`	IP address Klue identified as used by the threat actor to access sensitive information; Huntress also linked it to spam campaigns in March 2026.
IPV4	`212[.]86[.]125[.]24`	IP address Klue identified as used by the threat actor to access sensitive information.
IPV4	`213[.]111[.]148[.]90`	IP address Klue identified as used by the threat actor to access sensitive information.
IPV4	`94[.]154[.]32[.]160`	IP address Klue identified as used by the threat actor to access sensitive information.