On June 12, 2026, a company called Klue noticed something strange in its backend. Someone had pushed a code update nobody on the team recognized. By the time they’d finished tracing it, the intruder had lifted OAuth tokens for every customer using Klue’s integration with Salesforce and Gong, then spent up to 24 hours per target running automated scripts through 195 companies’ CRM records. The victim list reads like a security conference roster: Huntress, Recorded Future, HackerOne, Tanium, Jamf, LastPass, Snyk. Companies whose entire business is telling other people how to avoid exactly this.
The entry point wasn’t a zero-day or a clever phishing email. It was a credential created months earlier to prototype a third-party integration, then left active after the prototype was abandoned. Nobody remembered it existed. Nobody had a process to check.
This is not a one-off
If it were an isolated incident, we could file it under “unlucky.” It isn’t. The group tracked as ShinyHunters has run three overlapping playbooks against SaaS platforms this year: voice-phishing help desks into resetting SSO credentials, exploiting Salesforce Experience Cloud misconfigurations, and abusing OAuth tokens in supply chain integrations exactly like Klue’s. Between the three, they’ve hit more than 40 named organizations in 2026, including Charter Communications (4.9 million customer records, traced back to a single employee’s compromised Microsoft account), Kodak, DentaQuest, and Google’s own Salesforce instance. A related campaign built around Salesloft’s Drift integration reportedly touched 760 organizations and 1.5 billion records.
The pattern across all of them is the same: the target company usually did nothing wrong in the moment. Nobody clicked a bad link that day. They got hit because a vendor they trusted, or a vendor’s vendor, held a credential that should not have still worked, or ran a support desk that would reset a password over the phone for anyone who sounded confident enough.
Every integration is a door with someone else’s key
Modern SaaS products sell themselves partly on how many things they connect to. Slack, Salesforce, HubSpot, and dozens of smaller tools all encourage you to grant OAuth access so data moves automatically between them. Each grant is convenient. Each grant is also a standing door into your data that you don’t operate and rarely audit.
Most companies can list their own employees with Salesforce access. Very few can list every third-party app holding an OAuth token to that same data: when it was granted, whether it’s still needed, or who at the vendor is responsible for revoking it if their systems are compromised. Klue’s customers didn’t have a Klue problem, specifically. They had a “we don’t actually know what’s plugged into our CRM” problem, and Klue happened to be the plug that failed this time.
This is the quiet cost of buying instead of building: not the subscription fee, but the credential sprawl that accumulates underneath it. A tool adopted for one team, for one quarter, for one demo, can keep a live key into your core systems for years after everyone who set it up has moved to a different job.
What we’d actually check first
If you’re running a product with real customer data behind it, this is worth an afternoon, not a committee. Pull the OAuth grants list for your CRM, your identity provider, and any system holding customer PII. For each entry, ask three questions: do we still use this, does it need the scope it has, and do we know who at the vendor can tell us if it’s compromised. Kill anything you can’t answer, and put a reminder on the calendar to ask the same three questions again in six months, because the next stale credential is being created right now by someone testing a new tool for a project that will quietly end in September.
The longer-term fix isn’t “use fewer SaaS tools” as a blanket rule. It’s knowing exactly what surface you’re exposing and choosing it on purpose, rather than accumulating it by default. That’s a lot easier when the infrastructure underneath your product is something you actually control and can reason about, rather than a growing stack of marketplace connectors, each with its own security posture and its own forgotten prototype credentials. It’s the thinking behind our cloud and infrastructure work: access defined explicitly, infrastructure defined as code, nothing running just because someone clicked “allow” during a trial three years ago and forgot about it.
The honest tradeoff
We’re not going to tell you to rip out Salesforce. For a lot of businesses, it’s the right tool, and building your own CRM would waste a year you don’t have. The point is narrower: every integration you turn on is a decision to extend trust to a company whose security practices you can’t see and whose stale credentials you can’t audit. Sometimes that trade is worth it. Sometimes it isn’t, and the honest answer is that fewer, better-understood connections beat a long tail of “someone set this up in 2023 and it still technically works.”
That’s a design decision, not an afterthought, and it’s easiest to get right at the start of a project rather than retrofit it after 195 companies made the news for the same reason. If you’re weighing that tradeoff for a product handling real customer data, get in touch. We’d rather help you draw the map before something like this happens than help you clean up after.