Cómo llegamos aquí

Klue provides market intelligence to over 250,000 companies by connecting their data through integration tools. Hackers used a compromised legacy credential – reportedly provided to a third party in 2022 for a limited pilot – to access Klue’s systems earlier this month.

  • Klue detected the intrusion on June 12 and disclosed it last Friday.
  • The credential was associated with an integration service that links customer data to Klue’s platform.
  • Klue has not explained why the credential was never revoked after the pilot concluded.

Lo que sabemos (y lo que no)

The investigation is ongoing, and some key details remain unclear.

  • Qué se robó: Business contacts, price quotes, sales data, and messages – no passwords, payment info, or threat data, according to affected companies like Huntress.
  • Quiénes fueron afectados: At least a dozen cybersecurity firms have come forward, including LastPass, Recorded Future, Tanium, Jamf, HackerOne, Gong, Snyk, and Sprout Social. Huntress says “hundreds of Klue customers” were impacted.
  • Qué no se sabe: The type of credential (password or token), who the pilot third party was, how long the pilot ran, and whether the hackers stole the credential from Klue or from the third party.
  • El grupo responsable: Icarus claimed the attack and set a Monday ransom deadline to publish the stolen data.

El efecto dominó

By breaching Klue, Icarus targeted a single point of failure that held access to many companies’ cloud databases. This mirrors similar supply-chain attacks on middleware providers like Gainsight and Salesloft over the past year.

  • Victim companies stress that their own products and infrastructure were not compromised.
  • The stolen data was limited to CRM databases, such as Salesforce, where firms store customer information.
  • Several affected cybersecurity vendors have published transparency statements, confirming no password or telemetry data was leaked.

Qué sigue

Klue says its investigation continues, and the company has not disclosed how many customers are affected in total. Icarus has threatened to release the stolen data if Klue does not pay the ransom by Monday. The incident may prompt renewed scrutiny of how companies manage legacy credentials and third-party access in their integrations.