Hacked Klue Breach Takes a Messy Turn

Klue, a market research provider, was hacked earlier this month in a breach that allowed cybercriminals to steal reams of data belonging to several of its customers. The company says it's now communicating with the hackers, who claim to be deleting the stolen data, but a second gang of hackers is threatening Klue's customers directly.

Klue confirmed on Monday that hackers broke into its systems on June 12 and stole an unspecified amount of data from an unspecified number of its customers. Since then, several Klue customers have confirmed they were affected by the breach, including Gong, Jamf, HackerOne, Huntress, Insurity, LastPass, OneTrust, Recorded Future, ReliaQuest, Snyk, Sprout Social, and Tanium.

At the time, the hacking group Icarus was threatening Klue to release the stolen customers' data in an attempt to extort the company.

As of Thursday morning, when TechCrunch checked, the Icarus website appears to be down, which is also what Klue privately told its customers.

However, the hack got messier in the last couple of days. According to Klue, Icarus told the company that there is a second gang of hackers that is trying to extort its customers directly.

This unnamed gang posted a list of allegedly affected companies on its own website, where they claimed to have stolen Klue's customer data directly from Icarus. The hackers also alleged that Klue paid an "Icarus operator who is a teenager living somewhere in the UK or adjacent countries."

TechCrunch has obtained no independent verification that Klue paid Icarus, nor could we determine why the Icarus website is down. A Klue spokesperson did not immediately respond to a request for comment.

The hackers, who claim to have stolen Klue's customer data, are threatening to leak the information unless their demands are met.

Klue suggested its customers who are in touch with this second group of hackers to ask for a random sample of data, as proof that the hackers really possess the data they claim to have.

The company previously said that the hackers stole customers' data by using a 2022 third-party credential that was part of a limited pilot. The hackers then used their access to Klue's systems to steal customers' authentication keys — known as OAuth tokens — and log into their clouds and databases.

Klue has not provided more details about this stolen credential, such as who it was assigned to, or why it was not revoked in the last four years.