Skip to content
OriginalSign in
Image: Dark Reading

Dark ReadingRob Wright

Salesforce Data Leak Tied to Compromised Klue Battlecards App

Part of the Icarus story · since 18 Jun

Quiet for 18 weekslast report 26 Jun9 articles5 outlets
18 Jun · Dark Reading first26 Aug18 Sep11 OctNowThis article1st of 9
  • Thu 18 Jun, 17:20 UTC. Dark Reading, first report. Salesforce Data Leak Tied to Compromised Klue Battlecards App. This article, 1st of 9.
  • Fri 19 Jun, 09:30 UTC. SecurityWeek, its first report on the story. Klue supply chain breach leaks OAuth tokens via Salesforce API.
  • Sun 21 Jun, 15:16 UTC. DataBreaches, its first report on the story. Icarus hack steals OAuth tokens, leaks Klue Salesforce data.
  • Mon 22 Jun, 09:17 UTC. SecurityWeek. Klue supply chain breach leaks Salesforce data after hack.
  • Mon 22 Jun, 10:20 UTC. Infosecurity, its first report on the story. Klue breach leaks OAuth tokens, puts cybersecurity firms on alert.
  • Tue 23 Jun, 21:20 UTC. Dark Reading. Scope of Salesforce Attacks Expands as Icarus Leaks Data.
  • Wed 24 Jun, 02:00 UTC. SecurityOnline, its first report on the story. LastPass reports data breach after Klue hack exposes CRM data.
  • Wed 24 Jun, 10:31 UTC. SecurityWeek. LastPass breach via Klue exposes Salesforce data from Gong, 8x8.
  • Fri 26 Jun, 15:31 UTC. SecurityWeek. Klue supply chain hack leaks Salesforce data at two dozen firms.

The article from Dark Reading discusses a security breach affecting Salesforce customers through a compromise of the Klue Battlecards app. This marks the third incident involving third-party application integrations with Salesforce leading to unauthorized access to customer data. Klue's integration was suspended following unusual activity detected on June 17, 2026.

Researchers identified that attackers exploited compromised OAuth tokens to exfiltrate data, executing rapid queries against Salesforce instances over a concentrated 24-hour period. The breach appears linked to a new group called Icarus, which threatened disclosure of stolen data to victims, reinforcing concerns about supply chain vulnerabilities in SaaS integrations.

Recommendations for organizations include revoking and reissuing credentials tied to Klue's integration and tightening security measures around API access.

How the story developed

All 9 articles
Quiet for 18 weekslast report 26 Jun9 articles5 outlets

9 articles from 5 outlets since 18 Jun. Quiet since 26 Jun. This was the first report.

Now18 Jun202122232425262728First reportDark Reading · 18 Jun, 17:20Picked up againafter 2 days quietPicked up againafter 2 days quiet
  • Thu 18 Jun, 17:20 UTC. Dark Reading, first report. Salesforce Data Leak Tied to Compromised Klue Battlecards App. This article, 1st of 9.
  • Fri 19 Jun, 09:30 UTC. SecurityWeek, its first report on the story. Klue supply chain breach leaks OAuth tokens via Salesforce API.
  • Sun 21 Jun, 15:16 UTC. DataBreaches, its first report on the story. Icarus hack steals OAuth tokens, leaks Klue Salesforce data.
  • Mon 22 Jun, 09:17 UTC. SecurityWeek. Klue supply chain breach leaks Salesforce data after hack.
  • Mon 22 Jun, 10:20 UTC. Infosecurity, its first report on the story. Klue breach leaks OAuth tokens, puts cybersecurity firms on alert.
  • Tue 23 Jun, 21:20 UTC. Dark Reading. Scope of Salesforce Attacks Expands as Icarus Leaks Data.
  • Wed 24 Jun, 02:00 UTC. SecurityOnline, its first report on the story. LastPass reports data breach after Klue hack exposes CRM data.
  • Wed 24 Jun, 10:31 UTC. SecurityWeek. LastPass breach via Klue exposes Salesforce data from Gong, 8x8.
  • Fri 26 Jun, 15:31 UTC. SecurityWeek. Klue supply chain hack leaks Salesforce data at two dozen firms.
  • No CVE
  • Larger: an outlet’s first report
  • Coverage over time
  • Quiet time, folded
Show all 9 articles as a list
  1. Thu 18 JunDay 01
    1. Salesforce Data Leak Tied to Compromised Klue Battlecards App17:20 · Dark Reading · First report · This article, 1st of 9
  2. Fri 19 JunDay 11
    1. Klue supply chain breach leaks OAuth tokens via Salesforce API09:30 · SecurityWeek

  3. Quiet for 2 days

    Sun 21 JunDay 31
    1. Icarus hack steals OAuth tokens, leaks Klue Salesforce data15:16 · DataBreaches · Picked up again
  4. Mon 22 JunDay 42
    1. Klue supply chain breach leaks Salesforce data after hack09:17 · SecurityWeek
    2. Klue breach leaks OAuth tokens, puts cybersecurity firms on alert10:20 · Infosecurity
  5. Tue 23 JunDay 51
    1. Scope of Salesforce Attacks Expands as Icarus Leaks Data21:20 · Dark Reading
  6. Wed 24 JunDay 62
    1. LastPass reports data breach after Klue hack exposes CRM data02:00 · SecurityOnline
    2. LastPass breach via Klue exposes Salesforce data from Gong, 8x810:31 · SecurityWeek

  7. Quiet for 2 days

    Fri 26 JunDay 81
    1. Klue supply chain hack leaks Salesforce data at two dozen firms15:31 · SecurityWeek · Picked up again

Sources

CyberSIXTSignal over noise
Updated AboutDevelopersSign in