When a vendor's breach becomes yours: lessons from the Klue incident

There's an uncomfortable truth that every security team eventually runs into: the breach that hurts you most may not happen inside your walls at all. You can patch your code, rotate your secrets periodically, and keep your perimeter tight — and still wake up to find an incident because of a system you don't own.

That's the shape of the incident involving Klue, a market intelligence platform used by a wide range of companies for competitive intelligence. Based on what has been publicly disclosed, a threat actor compromised Klue's backend and used that foothold to reach into the connected systems of Klue's customers — including the Salesforce environments those customers had integrated with the platform. Also, other security vendors, such as Recorded Future, Tanium, Huntress, and Jamf, have been impacted and have shared updates publicly. It's worth pausing to examine what happened, because the mechanics are a clean illustration of how modern software-as-a-service (SaaS) ecosystems can be compromised.

The anatomy of the incident

According to the disclosures published so far, the chain ran roughly like this:

The initial entry point into Klue was an older credential — one reportedly created at some point for an integration prototype that was later abandoned, and then never deactivated. The access granted outlived the project for which it was built. A threat actor found it, and it still worked.

From there, the attacker reached the part of Klue's infrastructure that connects the platform to its customers' tools. Those connections run on OAuth tokens: the standing triggers so that Klue can read from and write to systems like Salesforce on their behalf. The attacker introduced code designed to harvest those tokens. With them in hand, they no longer needed to break into each customer one by one. They could authenticate as the discovered service account using the secret in the integration, query each customer's customer relationship management (CRM) data directly, and then exfiltrate it. Extortion attempts followed.

Strip away the specifics, and you're left with a familiar pattern: one weak link, a set of borrowed keys, and a blast radius that extends to everyone connected downstream. A single compromise didn't stay contained to a single company. It cascaded.

A note on Snyk

In the interest of the transparency we'd expect from any vendor, we want to be direct: Snyk was among the organizations affected by the Klue incident. Our investigation shows that, to our knowledge at this point in time, the impact was primarily limited to business data fields within the Salesforce environments. This includes customer business contact information and only the title and description from a limited subset of customer support cases. The body or contents of the support cases were not included, nor did it affect Snyk's products. There was no impact on our ability to serve our customers.

We acted on notification by disabling Klue's integration within Salesforce, launching our own review, and engaging the appropriate parties. For the current status and the most up-to-date details, please visit status.snyk.io or the Snyk Trust Center. We'll keep both updated as our review progresses.

If there's one thing we'd ask you to take from this beyond our own situation, it's to go look at the keys you've handed out — and the ones you've forgotten you ever made.