Back Feeds2.Feedburner

Klue breach lead to Salesforce data theft, Huntress affected

Feeds2.Feedburner •Zeljka Zorz • June 19, 2026

Cybersecurity vendor Huntress was among multiple companies hit by a breach originating at Klue, a market intelligence platform used to integrate CRM and sales data across various business tools. Huntress published a detailed account of the incident on June 18, framing it as a “security domino effect” that began with one compromised integration credential and cascaded into theft of customer data across several connected platforms, including Salesforce. Attack timeline According to Huntress’s writeup, the attackers … More →

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Icarus Group Exploits Klue OAuth Breach to Steal Salesforce Data In June 2026, a significant security incident involving Klue, a market intelligence platform, allowed the Icarus threat actor group to exfiltrate Salesforce CRM data from multiple organizations, including Huntress. The attack exploited OAuth tokens from Klue's Battlecards integration, enabling unauthorized access to customer Salesforce instances. The breach began on June 12, 2026, and involved automated scripts that queried Salesforce's REST API for nearly 24 hours, leading to the theft of sensitive CRM data. Salesforce has since disabled the Klue Battlecards integration to mitigate further risks. Both Huntress and ReliaQuest confirmed their data was compromised, and affected organizations are now facing extortion demands from the attackers. The full scope of the impact is still being assessed, but it highlights the vulnerabilities associated with third-party integrations. 65 sources 71

Extracted Entities

Klue breach lead to Salesforce data theft, Huntress affected

The full story

Extracted Entities

Attack Types (1)

Companies (3)

MITRE ATT&CK (1)