Competitive-intelligence software vendor Klue has confirmed a supply-chain breach that let attackers reach into customer Salesforce environments, a fresh example of how integrations between business tools can become a single point of failure.
How the Attack Unfolded
Klue said attackers used compromised legacy credentials to access its integration environment and obtain OAuth tokens connected to customer platforms. The incident occurred between June 11 and June 12, 2026, and the stolen tokens allowed unauthorized access to Salesforce CRM data across multiple customer environments. In response, Salesforce disabled Klue's Battlecards integration on June 17.
The mechanics of the breach are instructive. Rather than attacking each customer directly, the intruders compromised Klue itself and then used the trust relationships Klue had with its customers' Salesforce accounts. Because OAuth tokens act as long-lived keys granting access without re-entering passwords, seizing them effectively handed the attackers a set of pre-authorized doors into connected systems.
Timeline of the Incident
- Attackers used compromised legacy credentials to enter Klue's integration environment.
- Malicious activity took place between June 11 and June 12, 2026.
- Stolen OAuth tokens enabled access to customer Salesforce CRM data.
- Salesforce disabled the Klue Battlecards integration on June 17.
The Danger of Legacy Credentials
A recurring theme in modern breaches is the persistence of old, forgotten credentials that still work. Legacy credentials are often overlooked during security reviews because they belong to systems or accounts that are no longer actively managed. When those credentials remain valid, they offer attackers a quiet way in that bypasses newer defenses.
In Klue's case, the compromised legacy credentials were the entry point, and the OAuth tokens were the payoff. The combination shows why organizations are increasingly urged to inventory and retire unused credentials and to tightly control the scope and lifespan of integration tokens.
Why OAuth Tokens Are a Prized Target
OAuth tokens are designed to let applications talk to one another without repeatedly sharing passwords, which improves usability. But that convenience cuts both ways. A stolen token can grant access to sensitive data for as long as it remains valid, and because the access looks legitimate, it can be harder to detect than a brute-force login attempt.
- Tokens grant standing access without re-authentication.
- Malicious use can resemble normal integration traffic.
- Revoking tokens quickly is essential once a breach is suspected.
A Pattern of Integration Risk
The Klue incident is part of a broader wave of supply-chain and integration-related attacks targeting the connective tissue of the modern software stack. As companies wire together CRM systems, marketing tools, and analytics platforms, each connection becomes a potential pathway for attackers who compromise one vendor to reach many others.
Salesforce's decision to cut off the Battlecards integration reflects a defensive playbook increasingly common in these events: sever the compromised link to contain the blast radius while the situation is assessed. For customers, the episode is a reminder that the security of their data depends not only on their own defenses but on every third-party tool they authorize. Reviewing which integrations hold access to sensitive systems, and revoking those that are no longer needed, has become a core part of protecting business data against exactly this kind of cascading compromise.