June 17, 2026: 8x8, the cloud communications company, told the SEC in an Item 1.05 Form 8-K that an unauthorised party had copied data from its Salesforce CRM through a third-party integration. The data includes customer contact details and sales notes for current, former and prospective customers. 8x8 says the incident is not expected to have a material impact on its operations. Canonical: 8x8-klue-salesforce2026. Primary source: 8x8's Form 8-K filed June 17, 2026.
This was not a break-in through a single password. The access came through a connected application, the Klue Labs integration, and it reached data held in 8x8's sales systems. For customers and prospects the practical risk is the same however the access happened: someone now holds names, phone numbers and sales context that can make a message look genuine.
What happened
- June 11–12, 2026: the unauthorised access took place, according to 8x8's filing.
- June 13, 2026: 8x8 learned of the intrusion.
- June 17, 2026: 8x8 filed the 8-K describing the incident.
The attacker used the Klue Labs application, a third-party tool connected to 8x8's Salesforce environment. 8x8 says it worked with Klue and with Salesforce support to disable the integration and remove the unauthorised access. The filing says the investigation into the full extent of the incident is continuing, so the scope may still change.
What data was taken
8x8's filing describes three categories:
- Fragments of contract and opportunity records
- Sales team notes
- Customer contact details for current, former and prospective customers: names, business addresses, phone numbers and email addresses
8x8 calls the data competitively sensitive. The filing gives no count of affected people or records, so the catalog records the count as unknown rather than estimating one.
Why this data is useful to an attacker
Contact details on their own are a phishing target. Sales notes are worse, because they describe what a prospect was considering, which price was discussed and who the account manager was. A message that refers to a real deal, a real contract or a real salesperson is much harder to spot as fake. That is why leaked CRM data tends to show up in later fraud rather than as a single dramatic event.
Verified vs unknown
- Verified (8x8 8-K): the access window, the detection date, the Klue integration as the route, the data categories listed above, the steps taken to disable the integration, and the statement that the incident is not expected to have a material operational impact.
- Not disclosed: how many customers or prospects were affected, which accounts were included, whether the data has been published or sold, and any detail of the attacker's identity or method beyond what the filing states.
Context: the Klue wave
This incident belongs to a wider campaign that abused OAuth-connected third-party apps in Salesforce tenants. The campaign's catalog entry is klue-oauth-supply-chain2026. The practical lesson is that a well-secured CRM can still leak data through the applications connected to it, so the connected-app list is part of the attack surface.
Who is at risk
- Current 8x8 customers whose contacts and contract details were in the CRM.
- Former customers and prospects, who may have assumed their data was no longer held. The filing covers all three groups.
- Employees of customer organisations, because the contact details are for named people at companies, not only the companies themselves.
What to do
- Be suspicious of unexpected contract or renewal emails that mention a deal you recognise. Check the sender's domain, and call a number you already hold rather than one in the message.
- Verify any request to change payment or bank details through a known contact, never by replying to the email that asked.
- Do not share one-time codes or passwords with anyone who calls or messages about an account, even if they quote your name and phone number.
- If you administer a Salesforce org, review every connected app and OAuth grant, remove any you do not use, and limit who can install new ones.
- Ask 8x8 directly through its official contact channels whether your data was in the affected set. Do not use a link from an unexpected message to do this.
What is still open
Three questions are open: how many customers and prospects were affected, whether any of the data has appeared online, and whether the investigation will widen the set of records involved. The filing says the investigation is continuing, so each answer could change. Until 8x8 says otherwise, assume that contact and deal records reachable through the integration may have been copied.
Related reading
For another case where leaked details were used to make the first call sound credible, see SBI's KYC data breach. The pattern is the same: the leaked details come first and the impersonation follows.