Klue Reveals 2022 Credential Theft by Hackers Resulted in Customer Data Breaches
Klue, a market research firm, has revealed that a credential from a limited pilot program in 2022 was exploited by cybercriminals earlier this month, leading to the theft of substantial data from its corporate clients, including several firms in the cybersecurity sector.
This new information raises concerns regarding Klue’s security measures and their ability to phase out old credentials that could have prevented the data breaches affecting their customers.
The security breach at Klue, based in Vancouver, was detected on June 12 and made public last Friday. This incident enabled hackers to extract sensitive information from various clients, such as the password management firm LastPass, along with other cybersecurity entities. The hackers gained access to Klue’s systems, where OAuth tokens are stored, to retrieve and extort sensitive information housed in external databases and cloud services.
A representative from Klue, Katie Berg, informed TechCrunch that preliminary investigations reveal the credential exploited by the hackers was given to a third-party entity in 2022 for a specific, temporary pilot program.
When questioned for more details, Klue did not clarify the nature or duration of the pilot, nor did it identify the third-party involved. Additionally, the company has not stated why this credential remained active post-pilot.
Klue has not responded to further inquiries regarding the incident as of the time of reporting.
As the investigation into the incident continues, there remain unanswered questions. Klue has only indicated in a blog post that the compromised credential was related to an integration service but has not specified its exact form, such as whether it was a username and password or if the credential was obtained from the third-party rather than Klue’s own systems.
These specifics are vital for understanding the breach and could aid in preventing similar incidents in the future.
In its statement, Klue mentioned it is undertaking a thorough review of its credential management practices, third-party access controls, monitoring capabilities, and overall security processes, though they provided no further details.
A hacker group known as Icarus has claimed responsibility for the breach on its data leak platform, threatening to release the stolen data unless their ransom is paid.
Klue has not disclosed whether they have engaged with the hackers or if they intend to comply with their demands.
If you have more information regarding the Klue cyberattack or are a company impacted by the breach, we invite you to reach out securely via Signal.
