Klue

Klue Hack: Stolen Customer Data Being Deleted, New Threats

Market research provider Klue confirmed a June 12, 2026 breach in which attackers stole customer data and authentication keys. Klue says it is communicating with the threat actor known as “Icarus,” which told the company it is taking steps to delete stolen customer data and that the Icarus site is down. Klue also warned customers that a second, unnamed gang is attempting to extort Klue’s customers directly after claiming to obtain samples of data from Icarus; that group published a list and demanded ransom, claiming 195 affected customers. Klue reported attackers used a 2022 third-party credential (from a limited pilot) to access systems and exfiltrate OAuth tokens that allowed login to customer clouds and databases.

LastPass Customer Data Stolen via Klue Breach

Password manager LastPass is handling a data breach after attackers accessed customer information by compromising a third‑party market intelligence platform, Klue. Klue detected unauthorized activity on 2026-06-12 and says attackers likely used old, compromised credentials for an integration service. Through that access, attackers viewed LastPass support tickets containing customer names, phone numbers, email addresses, home addresses, support-case details and sales-relevant information; payment data included in support tickets may also have been exposed. LastPass says its internal systems and user vaults were not compromised, and it is notifying affected users by email. Actions taken include suspending Klue employees’ access to LastPass data, rotating API access tokens, and planning additional protections. Users are advised to monitor payment activity and consider changing associated email addresses to reduce phishing risk.

Klue: 2022 Credential Used in Customer Data Breaches

Market research firm Klue confirmed that a credential issued in 2022 for a limited pilot was used by hackers in June 2026 to steal data from multiple corporate customers, including LastPass and several cybersecurity companies. Klue detected the intrusion on June 12, 2026, and disclosed the incident on June 23, 2026. Attackers leveraged access to Klue’s systems — which store OAuth tokens used to access customer data in other clouds and databases — to download data and extort impacted companies. Klue says the credential was originally provided to a third party for a pilot in 2022 but has not explained why it wasn’t revoked or what type of credential it was. A group calling itself Icarus claimed responsibility and threatened to publish the stolen data. Klue says it is conducting a comprehensive review of credential management, vendor access controls, monitoring and deployment security.