Klue says hackers stole credential from 2022 that led to customer data breaches

Klue spokesperson Katie Berg told TechCrunch that the company’s investigation so far indicates that the credential used by the hackers to steal customers’ data “was originally provided to a third-party in 2022, for a limited pilot.”

When asked by TechCrunch, Klue would not explain the purpose of the pilot, how long it ran, or identify the third-party that the company gave the credential to. Klue also did not share why the credential wasn’t revoked following the conclusion of the pilot.

Klue did not respond to follow-up emails about the incident before publication.

Questions remain about the incident as the company says its investigation is continuing.

Klue hasn’t said what kind of credential was stolen, only stating in a blog post that it was a “legacy credential associated with an integration service.” Klue also would not say whether the credential was an employee’s username and password, for example, or if the company believes the credential was stolen from the third-party rather than from its own systems. 

These details may be crucial to understanding how the breach was carried out — and how to prevent a repeat incident.

Klue’s statement to TechCrunch added that the company is “conducting a comprehensive review of credential management, vendor-access controls, monitoring capabilities, and deployment security processes,” offering no further details.

A hacking group called Icarus took credit for the breach on its data leak site, and has publicly threatened to release the stolen data if its ransom isn’t paid.

Klue has not said if it has had contact with the hackers, or if it plans to pay their demands.

Do you know more about the Klue cyberattack? Are you a company affected by the breach? We would love to hear from you. To contact Zack Whittaker securely, reach out via Signal at username zackwhittaker.1337.