Old Credentials Become a Gap, Klue Customer Data Stolen by Hackers

JAKARTA - Klue, a Canadian market research company, confirmed a data leak of customers after hackers used old credentials or system access data from 2022. The stolen data includes that of a number of corporate customers, including cybersecurity companies.

As reported by TechCrunch, the credentials were initially given to third parties for a limited pilot project. This finding raises the question of whether the old access should have been disabled before being used in the attack.

The hack was detected on June 12 and was first revealed by Klue last Friday. The incident affected a number of customers, including LastPass, the password manager application maker, as well as several other cybersecurity companies.

Hackers took advantage of access to the Klue system that stores OAuth tokens. OAuth tokens are digital keys that allow one service to access data in another service without having to constantly ask for usernames and passwords.

With this access, hackers take customer data stored in cloud computing services and various other databases. The stolen data is then used to blackmail the victim company.

Klue spokesperson Katie Berg told TechCrunch that the results of the interim investigation showed that the credentials used in the attack "were initially provided to a third party in 2022 for a limited pilot project."

However, Klue has not explained the purpose of the project, how long it lasted, nor the identity of the third party who received the credentials. The company has also not answered why the access was not revoked after the project was completed.

A number of other questions are still hanging. Klue has not revealed the type of credentials that were stolen. In its blog post, the company only referred to it as old credentials related to integration services.

Klue also has not explained whether the credentials are in the form of user names and passwords belonging to employees or whether the access data was stolen from a third party, not from the company's internal systems.

The details are important to understand how the attack was carried out and how similar incidents can be prevented in the future.

In a statement to TechCrunch, Klue said it was conducting a thorough review of its credential management, vendor access controls, monitoring capabilities, and system implementation security processes. However, the company did not provide further details.

The Icarus hacker group claimed responsibility for the attack through its data leak site. The group threatened to publish stolen data if the ransom demand was not met.

Klue has not yet stated whether it has communicated with the hackers or whether the company plans to meet the demands.