Klue hackers used 2022 credential for customer data theft

Klue spokesperson Katie Berg stated that the credential was initially provided to a third-party in 2022 for a pilot program. The company has not disclosed the purpose of the pilot, its duration, the identity of the third-party, or the reason why the credential was not revoked after the pilot concluded. The exact nature of the credential, described as "legacy" and associated with an "integration service," also remains unclear.

The hacking group Icarus has claimed responsibility for the attack on its data leak site, threatening to release the stolen data if a ransom is not paid. Klue has not confirmed whether it has engaged with the hackers or intends to meet their demands. The company is currently conducting a comprehensive review of its credential management, vendor access controls, monitoring capabilities, and deployment security processes.