Klue

Klue is a competitive enablement and market-intelligence SaaS platform whose Salesforce integration can sit close to customer and prospect CRM records. The public incident is best framed as a trusted SaaS integration and OAuth-token exposure path, not as a confirmed Salesforce platform vulnerability. ^1,2,5,6

The operational question for downstream customers is whether Klue or Klue Battlecards had token-backed access into their Salesforce environment, which objects were reachable, and whether Salesforce API activity indicates customer, prospect, support, or commercial data access. ^3,5,6,7,30

Public customer notices now make this a concrete disclosure-pattern issue as well as a technical one: responders should preserve Salesforce logs, revoke and rotate integration tokens, scope CRM objects, and keep product-system compromise language separate from Salesforce business-data exposure. ^{11,12,32,33,34,35,38,39,40,41,42,43}

Klue is a competitive enablement and market-intelligence SaaS platform used by sales teams to synchronize battlecards, win/loss context, and competitive intelligence with CRM workflows. That business role matters: a Klue integration can sit close to sensitive Salesforce data such as accounts, contacts, leads, opportunities, notes, and customer relationship context. Public reporting and Klue's own statement describe unauthorized activity affecting part of Klue's integration infrastructure, with a compromised legacy integration credential used to obtain OAuth tokens that connected Klue to Salesforce. 02-Jul-2026 · Freshly reported (<24h) Klue's later CrowdStrike summary refines that mechanism: a previously compromised GitHub PAT was used to introduce unauthorized code into Klue's integration service and collect third-party integration credentials, including Salesforce OAuth access and refresh tokens. ^1,5,6,59

This is a supply-chain attack because downstream customers may be exposed through a trusted third-party application rather than through a direct compromise of their own infrastructure first. LastPass publicly confirmed a Klue-linked customer-data incident and said its LastPass product systems and vaults were not compromised. That distinction is important for executives and counsel: the event may still trigger CRM data, privacy, and notification analysis even where core product systems, password vaults, or endpoint infrastructure were not breached. ^3,4

26-Jun-2026 · Newly retained (>24h) LastPass's detailed response adds useful scoping language for counsel and customer communications: the company describes Salesforce and Gong integration context, token rotation, discontinued Klue access, law-enforcement cooperation, customer anti-phishing guidance, published IOCs, and a product/vault boundary. ³⁰ 26-Jun-2026 · Freshly reported (<24h) TechCrunch adds a second-wave extortion concern: Klue reportedly told customers the original criminals were deleting stolen data while another group had begun making threats. ³¹

26-Jun-2026 · Freshly reported (<24h) SecurityWeek now reports roughly two dozen public Klue-Salesforce impact disclosures and names an expanded set of customer-notice examples. ³⁶ 26-Jun-2026 · Newly retained (>24h) Obsidian adds tenant-forensics detail across impacted organizations, including Global Describe reconnaissance, QueryMore pagination, API-version deviation, user-agent deviation, and broad object harvest patterns. ³⁷

27-Jun-2026 · Newly retained (>24h) LogicMonitor/Catchpoint and Tanium add direct customer-disclosure boundaries: both tie the incident to Salesforce data exposure through Klue while separating that exposure from core product, production, monitoring, or cloud-infrastructure compromise. ^41,43 27-Jun-2026 · Newly retained (publication date not visible) Tines adds a trust-center boundary that Klue credentials were used to access Salesforce data, with no evidence of unauthorized access to the Tines platform or customer environments. ⁴²

28-Jun-2026 · Newly retained (>24h) OneTrust, Gong, and Insurity add three direct public-disclosure boundaries: OneTrust ties the event to Klue Battlecards/Salesforce CRM-related data without evidence of customer-tenant exposure; Gong scopes impact to customers who connected Klue with Gong and says call recordings/transcripts were not directly impacted; Insurity says a limited set of active credentials found in exposed CRM data were rotated or reset and that Insurity products were not involved. ^44,45,46

29-Jun-2026 · Freshly reported (<24h) AudienceView adds a fresh status-page resolution timestamp while retaining the older June 22 monitoring context for its Klue-Salesforce integration incident. ⁴⁷ 29-Jun-2026 · Newly retained (>24h) Link11 adds a direct CRM-data notice, while FINRA and ZeroFox add sector guidance, Icarus/ICARUS reinforcement, limited IOCs, and a caveat that Underground Uwu / Scattered Lapsus$ Hunters claims should not be collapsed into UNC6395/Salesloft Drift. ^48,53,54 29-Jun-2026 · Newly retained (publication date not visible) AlertMedia, Cresta, and Lucanet add undated trust-center disclosures that improve public victim boundary coverage without creating a universal impact model; Camunda is now handled separately because its latest trust-center update provides a dated source-specific boundary revision. ^49,50,51,52

30-Jun-2026 · Newly retained (>24h) ControlUp, Deel, and Saviynt add direct public customer-disclosure boundaries for Klue-linked Salesforce, CRM, sales, or business-contact data exposure while separating that exposure from their respective product, production, infrastructure, or product-customer-data environments. ^55,56,57 30-Jun-2026 · Newly retained (publication date not visible) ABBYY adds an undated trust-center disclosure stating Salesforce data accessed through Klue's integration was affected while ABBYY's network, products, and technology were not affected. ⁵⁸

04-Aug-2026 · Newly retained (>24h) Neon One adds a direct public notice-letter boundary: Klue provided an integration service for Neon One's Salesforce customer relationship management software, and the Klue incident resulted in unauthorized access to some personal information between June 11 and June 12. Neon One says the incident was contained and no further impact was identified. ⁷⁹

02-Jul-2026 · Freshly reported (<24h) Klue says CrowdStrike completed its investigation on June 30, found no evidence of threat-actor access outside systems related to the integration service, found no evidence of threat-actor activity in the Klue environment after June 12, and that Klue deployed CrowdStrike Falcon monitoring. ⁵⁹ 02-Jul-2026 · Newly retained (>24h) Camunda's latest trust-center update narrows Camunda's own impact boundary: exfiltrated data did not include support data and was limited to standard business-contact and account information in Salesforce CRM. ⁵⁰

04-Jul-2026 · Newly retained (publication date not visible) Postman's Security & Trust Portal adds a direct public customer-disclosure boundary: Postman says customer contact data and sales information were exfiltrated from its Salesforce environment via the compromised Klue service account between June 11-12, customer data was not accessed from Gong, and Postman's core platform services remain secure and were not impacted. ⁶⁰

07-Jul-2026 · Newly retained (>24h) eSentire adds another direct public customer-disclosure boundary: eSentire says it uses Klue, was among the organizations whose Salesforce data was accessed, and describes the exposure as minimal because the integration was tightly scoped with restricted OAuth permissions and a limited connected-app footprint. It reports no identified risk to customers from eSentire's services and excludes customer communications, support interactions, threat intelligence, telemetry, credentials, passwords, and payment-card data. ⁶²

08-Jul-2026 · Newly retained (>24h) Thinkproject adds a UAT CRM-specific public customer boundary: Klue had authorized software-integration access to that CRM environment, exfiltrated data may include business-contact and commercial information, Thinkproject products and services were not affected, and the CRM system is separate from the customer product platform. ⁶³

09-Jul-2026 · Newly retained (>24h) Snyk's July 8 status resolution adds investigation-closure confidence: Snyk says its Klue/Salesforce forensic investigation, conducted with Mandiant, is complete; the impact remained limited to business CRM data; and no Snyk platform or sensitive platform-data impact was found. ⁶⁴ 09-Jul-2026 · Freshly reported (<24h) Secure ISS's July 9 advisory relays a SentinelOne partner-notification boundary: the Klue impact was contained to SentinelOne's Salesforce environment through the Klue API integration, with no lateral movement and no core-product, cloud-infrastructure, or production-environment impact reported. Treat it as a qualified public advisory because the direct SentinelOne portal reference is access-controlled and data analysis remains ongoing. ⁶⁵

11-Jul-2026 · Newly retained (>24h) OneTrust's July 10 update closes its technical investigation, validates scope, and finalizes containment and remediation. OneTrust says the independent forensic investigation found no evidence of exposure beyond its Salesforce environment, while governance, compliance, and notification review remain ongoing. ⁴⁴

13-Jul-2026 · Freshly reported (<24h) Microsoft's July 13 research adds a fresh campaign-deconfliction layer: it groups Salesforce and SaaS OAuth-abuse activity observed from mid-2025 to mid-2026 as tradecraft commonly associated with ShinyHunters and includes Klue integration activity in that broader discussion. 18-Jul-2026 · Newly retained (>24h) Microsoft also names Storm-3138 for the Klue system-access path. Use this to strengthen OAuth/connected-app hunting and activity-cluster deconfliction while preserving Icarus/ICARUS as the Klue-specific public extortion/operator label unless a reliable source directly merges or replaces that attribution. ⁶⁶

14-Jul-2026 · Newly retained (publication date not visible) Sisense adds another direct public customer-disclosure boundary: its Trust Center says Sisense was one of many affected organizations and that the incident was limited to certain business and sales-related data in Sisense's Salesforce CRM application. Sisense states the product platform and data stored within the product platform were not impacted, and says it disconnected certain third-party integrations, rotated credentials and tokens to Klue and Salesforce, and is monitoring access logs. ⁶⁷

16-Jul-2026 · Newly retained (>24h) Qualtrics and Splashtop add two older direct public disclosure boundaries. Qualtrics says the Klue application connected to Salesforce for internal sales-team support, unauthorized access was limited to a subset of Salesforce data, impacted data included business-to-business identifiers, and Qualtrics products, core infrastructure, services, and hosted platform customer data were not accessed or compromised. Splashtop says Klue OAuth tokens were used to access certain Salesforce data, it disabled the Klue Salesforce integration and revoked access, the investigation remained ongoing, and Splashtop products and services were not impacted. ^68,69

23-Jul-2026 · Newly retained (>24h) Greenhouse and Blackbaud add direct Conveyor trust-center boundaries. Greenhouse says attackers obtained Klue credentials used to connect to certain Greenhouse business systems; access occurred on June 11, was scoped to Klue's integration, did not involve Greenhouse infrastructure, and was limited to business contact information in sales/customer relationship systems. Blackbaud's July 22 update says its investigation remains ongoing with no substantive update, no known impact to Blackbaud products, and no impact to business operations or customer-service ability. ^70,71

30-Jul-2026 · Newly retained (>24h) Klue's July 27 restoration update changes the operational posture from disabled integrations only to controlled re-enablement. Klue says Salesforce and Gong reinstated Klue integrations in their marketplaces, all Klue integrations are again available for customers to enable, and Klue added controls including static egress IPs allow-listed by Salesforce and Gong, platform-wide PKCE, tightened OAuth token lifecycle policies, elimination of GitHub personal access tokens, centralized monitoring and detection, runtime network filtering, and deployment-pipeline allowlisting. ⁷⁴

31-Jul-2026 · Freshly reported (<24h) Klue's CTO post adds the freshest primary engineering detail: the intrusion unfolded from GitHub PAT access into source-code download, additional PAT discovery, credential testing, build/deployment-path abuse, and a tampered production workload that enabled stored OAuth-token access. It reinforces CI/CD as a production security boundary and calls out durable controls around GitHub Apps or workload identity, default-deny network controls, refresh-token rotation or idle expiration, IP-range allow-listing, and low-privilege integration accounts where supported. ⁷⁵

02-Aug-2026 · Newly retained; undated Yext adds a direct SafeBase trust-center boundary: Yext says stolen Klue-held credentials were used to run read-only queries against Yext's internal Salesforce CRM for roughly 17 hours on June 11-12, exposing business contact details for customers and prospects. Yext excludes platform, product, infrastructure, customer-content, customer-facing-system, end-user-data, payment-card, Google Workspace, and Slack impact. ⁷⁶

03-Aug-2026 · Newly retained (>24h) Commvault and NetDocuments add older rendered public disclosure boundaries that improve customer-impact scoping without changing the upstream Klue/Salesforce OAuth mechanism. Commvault limits accessed data to Salesforce business relationship and sales activity information and excludes customer data, Commvault solutions/services, customer backup data, product metadata, and logs. NetDocuments says the NetDocuments Service was not impacted and limits the Klue-related impact to internal Gong-user staff-list data, while excluding customer data, prospective customer data, and Customer Repository Data. ^77,78

The best technical framing is OAuth/connected-app abuse in the Salesforce ecosystem. Klue says it revoked credentials and tokens, removed unauthorized code, disabled potentially impacted integrations, and notified law enforcement. ReliaQuest and Datadog add the operational layer: token-backed access, automated Salesforce REST API queries, OAuth refresh-token evidence, connected-app identification, and object-level scoping are the artifacts defenders should examine. ^1,5,6

For responders, the first question is not "did we patch Salesforce?" It is "did we use Klue or Klue Battlecards, what Salesforce data did that integration reach, and did token-backed API activity occur in our tenant?" The near-term response is to preserve Salesforce logs, identify Klue connected apps, revoke and rotate tokens and integration secrets, scope CRM objects queried or exported, and coordinate legal, privacy, and client communications around confirmed data access rather than speculative actor claims.