One OAuth grant, two dozen breached CRMs: the Klue lesson

Nobody breached LastPass. Nobody breached Snyk, HackerOne, Tanium, or Jamf. Attackers breached Klue — a competitive-intelligence tool their sales teams had connected to Salesforce — and walked out with CRM records from roughly two dozen companies. If you want a single case study in why an OAuth grant is not a minor integration decision, this is it. Notifications from the June incident were still landing with customers through late July.

What actually happened

Per Huntress, which was both a victim and a public investigator, the compromise started June 11, 2026. The attacker got into Klue's backend, then pushed a code update that harvested the OAuth tokens Klue's customers had issued for their Salesforce integrations. With those tokens, the attacker queried each customer's CRM directly — as Klue, with Klue's permissions.

ReliaQuest's analysis puts the operation at roughly 24 hours, including a burst of nearly a thousand API queries in 15 minutes and extraction windows running over six hours. Klue detected it June 12 and revoked the affected credentials and tokens. The initial access vector into Klue is still not public.

What came out was business contact data, support cases, trial and pricing details, and sales communications. LastPass confirmed customer vaults, master passwords, and encryption keys were never touched. SecurityWeek reports roughly two dozen companies have notified their own customers. The extortion crew, Icarus, claimed nearly 200 — then got hacked themselves, and the stolen data moved to a second actor running its own campaign.

Why your integrations matter for your business

Here's the part operators consistently underrate: an OAuth grant is a standing, credentialed copy of the data it can reach. When you clicked "Allow" on that Slack-to-CRM connector or the AI note-taker that reads your pipeline, you didn't share a report. You issued a key that works until someone revokes it, with whatever scope the vendor asked for — usually everything.

Three things, none of which require a security budget.

Enumerate the grants. Salesforce Connected Apps, Google Workspace third-party access, Microsoft Entra enterprise applications, your Slack app directory. Open each list. You will find integrations from vendors you no longer pay and pilots nobody remembers running. Revoke those today.

Scope what stays. Most connectors request broad read access because it's easy, not because they need it. A tool that surfaces competitor mentions on open opportunities does not need every contact record you own. If the vendor can't scope it down, that's information.

Know the blast radius before the call comes. For each remaining grant, write one line: what it can read, and what leaves your business if that vendor is compromised tomorrow. That single page is the difference between a two-hour scoping exercise and a three-week forensic dig.

Sources: Huntress, ReliaQuest, SecurityWeek, BleepingComputer.