When a vendor's breach becomes yours: lessons from the Klue incident

The Klue incident illustrates how a single vendor breach can cascade to all connected customers. A threat actor exploited an abandoned, never-deactivated credential in Klue's backend, harvested OAuth tokens used to connect Klue to customers' Salesforce environments, and exfiltrated CRM data from multiple organizations — including Snyk, Recorded Future, Tanium, Huntress, and Jamf. Snyk discloses that its exposure was limited to business contact fields and limited support case metadata, with no product impact. The key takeaway: audit and revoke stale credentials and OAuth tokens granted to third-party SaaS integrations before they become an attacker's entry point.