2026 Tanium — Klue OAuth supply-chain breach; Salesforce CRM data exfiltrated
Data compromised
Sales account/opportunity data, sales messaging, business contacts (names, titles, emails; some phones, social handles, business addresses)—no Tanium products, cloud infrastructure, support passwords, or customer security data per CISO notice
Technical writeup
Downstream Klue supply-chain victim — June 2026. Tanium CISO Paul Black disclosed June 18 that Klue's OAuth-integrated Battlecards platform breach allowed unauthorized exfiltration of Tanium's Salesforce CRM data while Tanium products and cloud infrastructure were unaffected. Potentially compromised categories include opportunity names/values, sales-related messaging, and business contact fields (names, job titles, emails; in some cases phones, social media contacts, addresses). Tanium blocked Klue OAuth access, engaged Klue leadership, and warned contacts of phishing/social engineering. Part of the multi-victim Icarus campaign (klue-oauth-supply-chain2026).
Root cause
Klue Battlecards OAuth integration compromise; Icarus actor exfiltrated Tanium Salesforce CRM via stolen tokens