An article from

Klue, a provider of a market intelligence platform, is investigating a supply chain attack that led to the mass exfiltration of Salesforce customer relationship management data belonging to hundreds of customers, including several prominent cybersecurity firms. 

A threat actor used a compromised Klue Battlecards app to gain access to OAuth tokens for connecting Klue with third-party integrations, including Salesforce, according to information from Klue and security researchers at Reliaquest, which warned about the attack in a recent blog post. 

Salesforce, which disabled connections through the Klue Battlecards app until further notice, said there is no indication of a vulnerability within its own platform. 

A threat actor tracked as Icarus posted stolen data from several victims on its website, according to a Monday blog post from Huntress. Itself a victim of the attack, Huntress said none of its internal systems were impacted.

The threat group has begun reaching out to companies whose customer data was compromised in the attack, said Charles Carmakal, CTO at Mandiant Consulting. 

Security firms impacted

Several other security companies, including LastPass, Recorded Future and Tanium, confirmed that hackers accessed certain customer data and said they have since revoked their integrations with the Klue app. 

LastPass, a firm that provides a password management app for consumer and enterprise users, said attackers gained access to standard CRM data, including names, emails, physical addresses, phone numbers and support-case data and sales-related information. 

There is no evidence the attack affected LastPass products, services or infrastructure. Klue OAuth tokens have since been rotated. 

Tanium confirmed that business contact information, including names, business addresses, job titles, email addresses and social media handles might have been stolen. In a blog post, Tanium said its own products and cloud infrastructure were unaffected.

Recorded Future officials said hackers were able to gain access to client contact names and email addresses stored within its Salesforce database, according to a blog post, and some information regarding business contracts might have been affected. There was no impact to Recorded Future’s core platform or any internal infrastructure. 

Klue has retained CrowdStrike and is conducting a thorough review of all of its security controls, credential management, monitoring and deployment processes. There is no indication that customer data stored within the Klue platform was impacted by the attack.