2026 Recorded Future — Klue OAuth supply-chain breach; Salesforce business data accessed
Data compromised
Limited to Salesforce business fields per company: client contact names and email addresses, certain business contract information—no Intelligence Graph, proprietary platform databases, or customer platform data
Technical writeup
Downstream Klue supply-chain victim — June 2026. Recorded Future confirmed June 17 that elements of its Salesforce account were impacted via a compromised OAuth token associated with the Klue integration—not a direct attack on Recorded Future infrastructure. The company stated it was an incidental victim by virtue of using the integration; impact was limited to Salesforce business data such as client contact names, emails, and potentially business contract fields. Recorded Future found no evidence that its Intelligence Graph, internal databases, or customer platform data were accessed. Engaged Salesforce for logs and reviewed all integrated third-party apps. Part of the Icarus OAuth campaign indexed under klue-oauth-supply-chain2026.
Root cause
Compromised Klue–Salesforce OAuth integration token (Icarus supply-chain campaign)