Klue 2026 OAuth Supply-Chain Data Breach

Salesforce notified Klue on June 12 of suspected third-party activity originating from Klue's API integration service. Klue said it disabled the affected GKE pods and compromised GitHub tokens and rotated OAuth credentials that same morning. The company's initial June 18 update said the actor accessed data in a number of connected customer environments, while there was no evidence that customer content stored in the Klue platform was affected.

Klue said CrowdStrike completed its investigation on June 30 and published a summary of the findings on July 1. That summary reported no evidence of access to Klue systems outside those associated with the integration service and no actor activity in the Klue environment after June 12. Investigators did not determine how the original GitHub token was obtained. These are the boundaries of the published investigation; they are not expanded into a claim that every possible effect in connected third-party environments was excluded.

The structured classes are limited to third-party integration credentials and authentication tokens. The official summary specifically says the latter included Salesforce OAuth access and refresh tokens. These classes do not mean every Klue customer, every connection, or content stored in the Klue platform was affected. Later notices from individual institutions are maintained as their own event records; they are not merged with this parent integration incident to produce a duplicate count.

In addition to token rotation and pod shutdown, Klue described work on access controls, network segmentation, secrets management, monitoring, and controlled integration re-enablement. Organizations directly notified by Klue or a connected platform should revoke and replace the relevant OAuth tokens and review connected-app permissions and access logs for the June 11–12 period within their own scope. For users who did not receive a notice, the published sources do not establish person-level impact.