RiskEvents
ClosedMedium impactAI Refreshed

Klue OAuth Breach Enables 'Icarus' Salesforce Data Theft Extortion Campaign

Occurred 1 Jan 2022·Detected 19 Jun 2026·
🇺🇸 Cloud-based SaaS platforms affecting organisations primarily in the United States and Canada7 reportsEnded 29 Jun 2026
CyberCyberCasualty & Liability

Market-intelligence platform Klue disclosed a backend compromise in which threat actors stole OAuth tokens used to integrate with customer Salesforce environments, then exfiltrated CRM data and issued extortion demands attributed to the newly emerged 'Icarus' group. Huntress and LastPass have publicly confirmed impact; Salesforce has disabled the Klue Battlecards app. The incident resembles prior ShinyHunters-style third-party SaaS supply-chain attacks, with potential aggregate exposure across first-party cyber, cyber crime, and cyber liability coverages.

AI-generated from linked source reports. See our correction policy.

Impact verdict

Medium impact. MEDIUM: Supply-chain compromise of OAuth tokens affecting multiple enterprise Salesforce environments is relevant to London cyber underwriters. Loss pathway: multiple named affected organisations (Huntress, LastPass confirmed) with CRM data exfiltration and active extortion. Evidence: OAuth tokens stolen from Klue enabling data theft across customer environments; extortion emails sent. Limit: no loss estimates provided; scale of affected organisations and aggregate insured exposure unquantified; no evidence of ransomware encryption or business interruption to date.

View assessment methodology

Premium discovery tier

Unlock analyst briefs, intelligence depth, and the revision timeline

Public pages show event facts and a short lead-in. Premium accounts unlock analyst briefs, deeper intelligence, loss context, and the full revision history for this event.

Start two-week trial

Geographic Zone Matches

3 active matches

  • TRIA Certified Areas
    Rule-basedConfidence 100%
  • Pacific Ring of Fire
    Rule-basedConfidence 100%
  • Caribbean Hurricane Zone
    Rule-basedConfidence 100%

Geographic zone matches are RiskEvents spatial/analytical indicators, not coverage determinations or Lloyd's official classifications.

Affected countries

🇨🇦 Canada🇺🇸 United States

Lloyd's classifications

Tracking this kind of risk? Get an email when Cyber events escalate.

Get alerts
← Back to live events