Klue hack results in data breach at several cybersecurity firms

A hacking radical has taken recognition for a breach astatine marketplace quality supplier Klue that allowed hackers to bargain reams of information from the company’s firm customers, which see immoderate of the biggest names successful cybersecurity.

Vancouver-based Klue, which lets companies behaviour marketplace probe by connecting their information to its systems, said connected Friday that hackers had stolen information from an unspecified fig of its customers during a cyberattack a week earlier. (The blog contains the “noindex” code, which tells hunt engines to not database the leafage successful hunt results.)

Cybercrime radical Icarus took recognition for the breach, saying connected its leak tract that it volition people the stolen information connected Monday if the institution does not wage the hackers’ ransom.

Klue has not said however galore of its hundreds of customers are affected. Several companies person travel guardant to corroborate they had information stolen during the attack, including Gong, Jamf, HackerOne, Insurity, OneTrust, Recorded Future, Snyk, Sprout Social, and Tanium.

This is the latest of a slew of broad-scale hacks successful which hackers people companies that clasp the keys to different companies’ unreality databases. By breaching firms similar Klue, hackers are betting that compromising a azygous point-of-failure volition fto them bargain information from a ample fig of organizations astatine once. Over the past twelvemonth alone, hackers person progressively targeted akin middleware providers, including Gainsight and Salesloft, to summation entree to hundreds of companies’ data.

Klue said hackers had gained entree to the company’s systems connected June 12 utilizing a “compromised bequest credential,” specified arsenic a password oregon a token, associated with an integration instrumentality that allows customers to nexus their company’s unreality information to their Klue accounts. 

The hackers were capable to bargain information from Klue’s lawsuit clouds, specified arsenic Salesforce databases. Companies often store their customers’ idiosyncratic accusation successful Salesforce databases, making these a premier target.

Much of the stolen information includes concern interaction information, similar names, email addresses, telephone numbers, occupation titles, and immoderate relationship accusation of their customers, according to the assorted affected companies.

It’s not wide however the hackers acquired the compromised credentials, oregon wherefore Klue did not observe the theft sooner. Similar caller mass-hacks involving the compromise and misuse of credentials, specified arsenic astatine Snowflake and Tanstack, person been linked to employees inadvertently installing password-stealing malware connected the devices that they usage for work. 

Klue said it has called successful incidental effect steadfast CrowdStrike, and has disconnected its integrations to forestall further entree to customers’ data.

When contacted by TechCrunch connected Monday, Klue CEO Jason Smith did not instantly respond to a petition for comment, oregon reply questions astir the incident, including if the institution has received immoderate connection from the hackers, specified arsenic a ransom demand.

Huntress, 1 of the information companies that had its information stolen successful the hack, said successful its write-up of the incident that the hackers had contacted it with a ransom enactment utilizing an Australian company’s email address, whose servers were apt misused for the campaign.

Last June, Klue said it was preparing to laic disconnected astir fractional of its staff, astir 100 people, arsenic it doubled down connected its AI investments. It’s not wide if the simplification successful unit led to lapses successful information astatine the company. It’s not wide who, beyond Smith, is liable for cybersecurity astatine the company.

Klue does not presently database a idiosyncratic overseeing cybersecurity connected its enforcement enactment page.

Do you cognize much astir the Klue cyberattack? Are you a institution affected by the breach? We would emotion to perceive from you. To interaction Zack Whittaker securely, scope retired via Signal username zackwhittaker.1337 oregon by email: zack.whittaker@techcrunch.com.