Full Report
Huntress was one of many vendors impacted by a recent incident at Klue. We dug into the incident to figure out what happened.
Analysis Summary
# Incident Report: Klue Salesforce Data Breach
## Executive Summary
In June 2026, the software company Klue suffered a data breach that resulted in the exfiltration of Salesforce-related data belonging to its customers, including Huntress and nearly 200 other organizations. The threat actor group "Icarus" claimed responsibility, performing bulk exports of Salesforce environments to extract business contact information and sales communications. While the impact involves significant exposure of B2B lead and customer metadata, current evidence suggests no compromise of core product infrastructure, passwords, or payment card data.
## Incident Details
- **Discovery Date:** Approximately June 18, 2026 (Initial public report/impact awareness)
- **Incident Date:** June 2026
- **Affected Organization:** Klue (Primary); Huntress and ~200 other companies (Downstream victims)
- **Sector:** Software / Business Intelligence / Cybersecurity
- **Geography:** Global (Klue is a Canadian-based company; data leak hosted via Russian infrastructure)
## Timeline of Events
### Initial Access
- **Date/Time:** Early June 2026
- **Vector:** Targeted compromise of Klue (third-party vendor).
- **Details:** The threat actor gained unauthorized access to Klue’s systems, which had integrations with the Salesforce environments of Klue’s customers.
### Lateral Movement
- **Details:** Attackers utilized Klue’s access/permissions to perform bulk exports of data from connected Salesforce instances.
### Data Exfiltration/Impact
- **Date/Time:** Ongoing through June 22, 2026.
- **Details:** Exfiltration of business contact information (names, emails, phone numbers), subscription details, sales quotes, and free-form opportunity notes. A file named `stripeGC_Stripe_Account_c.json` was exfiltrated but contained only metadata, not financial data.
### Detection & Response
- **June 18, 2026:** Huntress and others identified as victims of the Klue breach.
- **June 22, 2026:** Icarus threat group publishes stolen data on a leak site. Huntress researchers pull the data for forensic analysis.
- **June 24, 2026:** A second, separate unauthorized party claims access to the data and threatens daily releases of 200+ company names unless a "compromise" (extortion) is met.
## Attack Methodology
- **Initial Access:** Compromise of third-party vendor (Klue).
- **Persistence:** Not explicitly detailed, but involved sustained access to vendor-customer integrations.
- **Discovery:** Reconnaissance of Salesforce object structures (e.g., searching for Stripe integrations or customer contact tables).
- **Collection:** Bulk export of Salesforce data objects and JSON metadata.
- **Exfiltration:** Data uploaded to a leak site hosted on a "bulletproof" AS (AS200593).
- **Impact:** Data theft and multi-stage extortion (double extortion via a second threat group).
## Impact Assessment
- **Financial:** No direct theft of funds or credit card data reported; however, potential for extortion costs and lost sales productivity.
- **Data Breach:** Exposure of B2B contact info, pricing, and internal sales strategy notes for nearly 200 companies.
- **Operational:** Significant resource allocation for incident response and customer notification.
- **Reputational:** High impact for Klue as the source of the breach; moderate for victims who must explain the exposure of customer contact data.
## Indicators of Compromise
- **Network Indicators:**
- `AS200593` (PROSPERO OOO, Registered in Russia)
- Specific clearnet IP addresses associated with the "Icarus" leak site (shared with law enforcement).
- **File Indicators:**
- `stripeGC_Stripe_Account_c.json` (Note: In this context, this was a benign metadata file but serves as an indicator of targeted objects).
- **Behavioral Indicators:** Bulk export activity within Salesforce originating from Klue’s integrated service account.
## Response Actions
- **Containment:** Coordination with Klue to sever compromised integrations.
- **Eradication:** Investigation of leaked datasets to verify the extent of the breach.
- **Recovery:** Notification to impacted partners and customers regarding the specific scope of their exposed business data.
- **Legal:** Sharing of threat actor infrastructure details with appropriate law enforcement agencies.
## Lessons Learned
- **Third-Party Risk:** Even "read-only" or sales-enablement integrations can expose sensitive business strategy and contact data if the vendor is compromised.
- **Metadata Misinterpretation:** Threat actors may leak files with sensitive-sounding names (like "Stripe") that contain no actual sensitive data to increase extortion pressure.
- **Secondary Extortion:** Data breaches are now attracting "bottom feeders"—secondary actors who claim access to the original stolen data to attempt their own extortion cycles.
## Recommendations
- **Least Privilege:** Audit Salesforce and CRM integrations to ensure third-party vendors have the absolute minimum access required.
- **Audit Logs:** Monitor for unusual bulk data exports or high-volume API calls from integrated third-party applications.
- **Vendor Assessment:** Regularly review the security posture of B2B SaaS providers that handle customer or lead data.
- **Incident Preparedness:** Maintain a clear inventory of what data is shared with which sub-processors to speed up impact assessment during a breach.