Klue says hackers stole credential from 2022 that led to customer data breaches

Klue, a market research firm based in Vancouver, has revealed that a credential from a limited pilot conducted in 2022 was exploited by hackers earlier this month to access sensitive data from its corporate clients, including notable cybersecurity firms. This alarming revelation has raised concerns regarding the company's security measures and the adequacy of its response to such vulnerabilities. The breach, which Klue detected on June 12 and publicly disclosed last Friday, allowed unauthorized individuals to gain access to crucial data stored in various cloud services and databases. Among the affected clients is the well-known password management service, LastPass, alongside other cybersecurity entities. The hackers utilized their access to Klue's systems, specifically the OAuth tokens, to facilitate the data theft and extortion of their targets. Katie Berg, a spokesperson for Klue, informed TechCrunch that the compromised credential was initially provided to a third-party for testing purposes in 2022. However, Klue has not disclosed the specifics of the pilot, including its duration or the identity of the third-party entity. Moreover, questions persist about why the credential remained active beyond the pilot's completion. As the investigation continues, Klue has not specified the nature of the stolen credential, referring to it only as a "legacy credential associated with an integration service." The ambiguity surrounding whether the credential was a username and password of an employee or if it was compromised from the third-party raises significant concerns about the security of both Klue and its partners. To address these vulnerabilities, Klue has announced a thorough review of its credential management practices, vendor-access controls, monitoring capabilities, and deployment security protocols. However, details on the specific actions being taken remain sparse. The hacking group Icarus has claimed responsibility for the attack, threatening to publicly release the stolen data unless their ransom demands are met. Klue has not confirmed whether it has engaged with the hackers or if it plans to comply with their demands. The situation remains fluid, and further developments are anticipated as Klue continues its investigation.