Klue Supply-Chain Compromise Exposed Customer CRM and SaaS Data

Summary

An advisory reports that attackers compromised Klue’s backend, stole customer integration OAuth tokens, and used them to extract CRM and other business data from connected SaaS services, including systems used by Huntress.

Key points

The advisory says an attacker used a long-unused but active Klue credential to access its backend and plant code that harvested customer OAuth tokens.
Stolen tokens were used to query and extract data from downstream services, including Salesforce, HubSpot, SharePoint, Zoom, Gong, Chorus.ai, Clari, Google Drive, and Slack.
Reportedly exposed information included contacts, pricing, sales communications, and internal notes; Huntress was among the affected organizations.
The advisory reports no identified compromise of Huntress’s core product infrastructure, engineering systems, threat telemetry, payment data, or passwords.
Observed activity included bulk queries to Salesforce’s `/services/data/v59.0/query/` endpoints, unusual or blank User-Agent strings, and Python-based automation.
Recommended response includes revoking and rotating integration tokens, invalidating sessions, reviewing API and authentication logs, and auditing legacy integrations.

Article Details

Victim Organization: Klue and downstream customers, including Huntress
Victim Domain: Unknown
Incident Type: Software supply-chain compromise involving theft of OAuth tokens and exfiltration of data from connected customer SaaS applications
Data Types Exposed: Contacts
Pricing information
Sales communications
Internal notes
CRM and other sales-related business data
Affected Records: Unknown
Affected Data Size: Unknown
Operational Impact: Unauthorized access to customer integrations and API-driven extraction of data from downstream systems. No compromise of core Huntress product infrastructure or threat telemetry was identified.
Ransom Or Extortion: Unknown; the article recommends monitoring for extortion-related messages but does not report that extortion occurred.
Claim Status: confirmed

Indicators of compromise

Type	Indicator	Context
IPV4	`138[.]226[.]246[.]94`	Listed in the incident advisory as an IOC associated with the compromise.
IPV4	`212[.]86[.]125[.]24`	Listed in the incident advisory as an IOC associated with the compromise.
IPV4	`213[.]111[.]148[.]90`	Listed in the incident advisory as an IOC associated with the compromise.
IPV4	`94[.]154[.]32[.]160`	Listed in the incident advisory as an IOC associated with the compromise.