A cybercriminal organization has claimed responsibility for a significant data breach at Klue, a market intelligence provider, which resulted in the theft of extensive data from some of its prominent corporate clients in the cybersecurity sector.
Klue, based in Vancouver, specializes in enabling companies to conduct market analysis by linking their data with its platform. On Friday, Klue announced that a cyberattack had compromised an unspecified number of its clients’ data a week prior.
The hacking group, known as Icarus, has stated on its leak site that it plans to release the stolen data on Monday if Klue does not comply with its ransom demand.
Klue has not disclosed the total number of affected clients among its extensive customer base. Several companies, including Gong, Jamf, HackerOne, Insurity, OneTrust, Recorded Future, Snyk, Sprout Social, and Tanium, have confirmed that their data was compromised during the attack.
This incident is part of a growing trend where hackers target firms that manage data for numerous organizations. By breaching a single company like Klue, they can potentially access the data of multiple clients simultaneously. In the past year, similar attacks have been directed at middleware providers such as Gainsight and Salesloft to access data from a wide range of companies.
According to Klue, the attackers accessed their systems on June 12 by exploiting compromised legacy credentials—such as passwords or tokens—related to an integration tool that enables customers to connect their cloud data to Klue’s services.
The hackers managed to extract information from various customer databases, including those hosted on Salesforce. These databases often contain sensitive customer information, making them attractive targets for cybercriminals.
The stolen data primarily consists of business contact details like names, email addresses, phone numbers, job titles, and some account-related information, as reported by the involved companies.
The method by which the hackers obtained the compromised credentials remains unclear, as does why Klue did not catch the intrusion sooner. Recent similar breaches, including incidents involving Snowflake and Tanstack, have been attributed to employees inadvertently installing malware that steals passwords on their work devices.
In response to the breach, Klue has enlisted the help of incident response firm CrowdStrike and has severed its integrations to mitigate further data access.
When approached for comment on Monday, Klue’s CEO Jason Smith did not respond immediately or provide information regarding any communications from the hackers, including any ransom requests.
Huntress, one of the security firms affected by the breach, noted that the hackers reached out to them with a ransom message using an email address associated with an Australian company, suggesting the misuse of that company’s servers for their activities.
Last June, Klue announced plans to reduce its workforce by approximately half, affecting around 100 employees, as it focused on increasing its investments in AI technology. It remains uncertain whether this staffing reduction impacted the company’s security protocols or who, apart from Smith, is accountable for cybersecurity within Klue.
Currently, Klue does not have anyone designated to oversee cybersecurity listed on its executive leadership page.
If you have insights concerning the Klue cyberattack or are part of a company impacted by this incident, we welcome your input. Please reach out securely to the journalist through their provided means.
