Salesforce Disables Klue App Integration After OAuth Token Abuse Exposes Customer Data

Summary: Salesforce disabled the Klue Battlecards app integration after its security teams detected unusual activity that may have exposed a subset of customer data through the app's connection, stating the issue was limited to Klue's app connection and not a Salesforce platform vulnerability. Klue said attackers used a compromised legacy credential to obtain OAuth tokens connecting Klue to third-party platforms including Salesforce, and the Icarus extortion group listed Klue as a victim on June 19, 2026, with Huntress confirming 3.4 GB of its Salesforce CRM data was posted.
Key Takeaway: ReliaQuest observed automated Python scripts running a query loop for almost 24 hours, including nearly a thousand queries in 15 minutes against one environment, from a trusted integration account that drew no usual alarms. The stolen token was Klue as far as Salesforce was concerned, so no password, MFA code, or phished employee was needed to pull CRM records at scale.

Read the original at The Hacker News ↗

Topics: Data Breaches
Related: TSMC employee data breach linked to cloud provider Cyber Risks · Nov 15, 2026
Data Breach at La Poste Subsidiary Maileva Affects 22 Million People in France Cyber Risks · Nov 15, 2026
City of Osaka warns of data breach impacting 1 million as Japan reels from dozens of cyber incidents Cyber Risks · Nov 13, 2026