Klue breach came through a tool your team forgot it bought

SolarWinds turned a trusted software update into backdoors at 18,000 customers. MOVEit turned one file-transfer product into 90 million victims. Klue turned a forgotten sales integration into stolen CRM data at two dozen software companies. None of them were breached at the front door. Their vendors did it for them.

I ran the Klue breach through CrisisCommand® to see where the exposure would land next. The pattern was old. The platform you stopped thinking about is the door you left open.

Klue decided, years ago, to connect its Battlecards product to its customers' core systems and never look back. In June 2026 an attacker used a compromised legacy service-account credential to reach Klue's backend and steal customer OAuth2 tokens for those integrations across Salesforce, HubSpot, SharePoint, Zoom, Gong, Chorus, Clari, Google Drive, and Slack. Bulk exfiltration ran June 11 to 12. Roughly two dozen software companies were confirmed as victims, including LastPass, Snyk, and OneTrust, with reports of up to about 195 customers potentially affected. Then FINRA issued a cybersecurity alert, and the first attacker was itself hacked, handing the data to a second actor running a fresh extortion campaign. Every victim inherited an investigation into a tool most of them barely remembered approving.

Snowflake decided in 2024 that authentication was the customer's job. It was right, and it did not matter. A threat actor used credentials stolen by infostealer malware to log directly into about 165 customer environments that had not turned on multi-factor authentication. No flaw in Snowflake's platform was touched. The downstream victims were enormous anyway: call and text metadata for roughly 110 million AT&T records, around 560 million Ticketmaster records. "The platform wasn't breached" was accurate and useless as a defense.

Progress Software decided its MOVEit file-transfer tool was plumbing. In May 2023 the Cl0p group exploited a single zero-day and mass-harvested data from everyone running it. Because MOVEit sat deep in the outsourcing chain, used by payroll providers, banks, agencies, and universities, one flaw cascaded to more than 2,700 organizations and over 90 million people, most of whom had never heard the vendor's name. The bill was a multi-year tail of class actions.

The breach you plan for comes through your own front door. The breach that lands comes through a vendor's forgotten integration. Every OAuth token you granted a SaaS tool is a standing key to your data that lives on someone else's server, and you renew it every day by forgetting it exists.

When a regulator opens an inquiry into a tool your team connected two years ago, the first question is not whether anyone was careless. It is whether you can even produce the list of who holds a live token into your systems. Most companies cannot produce that list. That inventory gap is the exposure, and it was sitting there long before the attacker arrived.

The sequence is always the same. A team connects a SaaS tool to move faster. The token is granted once and never reviewed. The vendor stores it, ages it into a service account, and forgets it in turn. An attacker finds the credential and pulls every connected system at once. Containment looks like closure right up until the stolen data changes hands and a second extortion begins.

What works

• Keep a live inventory of every third-party token into your systems. You cannot revoke what you cannot see, and the breach starts with what nobody was watching.
• Treat containment as a phase, not an ending. Klue's data moved to a second extortionist after the first was handled. Plan for the exposure to compound.
• Say what you know narrowly and precisely. "No evidence the attacker accessed Gong data" survives contact with the facts. A broad reassurance you have to walk back does not.

What does not work

• Hiding behind "the platform wasn't breached." Snowflake was technically correct and paid the reputational bill in full.
• Trusting a signed vendor because it is signed. SolarWinds arrived inside an update customers were told to install.
• Measuring blast radius by your own walls. MOVEit never touched most of its victims directly, and it took down 90 million of them.

SolarWinds shipped the backdoor inside an update it told customers to trust. MOVEit turned one flaw into 90 million people who never chose Progress Software. Klue handed two dozen software companies a breach through a tool their sales teams connected and forgot. None of them were breached at the front door. The door was one they had already propped open for a vendor, and by the time the investigation arrived, they could not name who held the key.

Commentary on public reporting. CrisisCommand does not represent the companies named. CrisisCommand is decision-support software, not legal advice.