The heel of Klue customers whose Salesforce data was stolen in the latest supply-chain heist keeps growing, with an increasing number of cybersecurity companies disclosing that they are among the victims of a new data-theft and extortion crew called Icarus.
Klue, which provides market intelligence to more than 250,000 users worldwide, hasnt said how many of its customers were caught up in the transgress and didnt immediately respond to The Registers inquiries.
Huntress was single of the first cybersecurity vendors to sound the alarm, and, in an email to The Register, said that it was among the hundreds of Klue customers affected. However, it said that the breach did not affect its tools or highly secure information such as passwords.
Huntress believes in radical transparency about security incidents, including when it affects our company, the security shop wrote on Thursday. The data that was copied from our Salesforce account includes concern contacts, price quotes, and other sales-related data and messaging. no terror data, passwords, payment card information, or engineering data relating to the Huntress agent or telemetry we collect was affected.
Huntress, along with the other victim companies, said that there is no indication that any of its products or infrastructure were compromised, and that this certificate incident was specific to CRM data.
Since then, several other security and software vendors including Recorded Future, Tanium, Jamf, Gong, HackerOne, Kudelski Security, Snyk, Insurity, and Sprout Social get revealed that the data thieves also accessed their CRM data via the Klue integrating with Salesforce.
Heres what we do know about what happened and who is behind this latest extortion campaign.
The breach occurred on June 11, and Klue spotted the intrusion a day later. This unauthorized activity affected a portion of its integrating infrastructure, according to the software provider.
Klue has since disconnected all of its integrations with Salesforce, Gong, HubSpot, SharePoint, and Google Drive. It also hired CrowdStrike to assist in the investigation and surety response.
Our investigation determined that an attacker gained access through a compromised legacy credential associated with an integration service, Klue CEO Jason smith said in a Friday blog post. The aggressor used that access to obtain OAuth tokens used to join Klue with certain third-party platforms, including Salesforce, and subsequently accessed data within a number of connected customer environments.
