A hacking group has claimed responsibility for an intrusion at market intelligence provider Klue, enabling the theft of extensive customer records from numerous corporate clients that include prominent cybersecurity organizations.

Vancouver-based Klue, which enables firms to perform market research through connections between their data and its platforms, disclosed on Friday that attackers had taken information from an unknown quantity of its clients in a cyberattack occurring the prior week.

Cybercrime group Icarus asserted credit for the intrusion on its leak site, stating it plans to release the stolen information on Monday unless the firm pays the demanded ransom.

Klue has not disclosed how many of its hundreds of clients are impacted. Multiple organizations have confirmed data loss in the incident, such as Gong, Jamf, HackerOne, Insurity, OneTrust, Recorded Future, Snyk, Sprout Social, and Tanium.

This incident represents the latest in a series of large-scale attacks where intruders focus on providers that manage access to other firms' cloud environments. By targeting entities like Klue, attackers aim to exploit a single vulnerability to extract records from many organizations simultaneously. In the past year, similar middleware suppliers including Gainsight and Salesloft have faced comparable targeting.

Klue reported that intruders accessed its systems on June 12 via a compromised legacy credential tied to an integration tool used by clients to connect their cloud data with Klue accounts.

The attackers extracted information from Klue customer clouds, including Salesforce repositories. Organizations frequently hold client personal details in such databases, rendering them attractive targets.

The compromised records primarily consist of business contact details such as names, email addresses, phone numbers, job titles, and limited account data, based on statements from the affected organizations.

It remains unclear how the credentials were obtained or why Klue failed to notice the activity earlier. Comparable credential-based incidents at Snowflake and Tanstack have been associated with staff accidentally deploying password-stealing malware on work devices.

Klue stated it engaged incident response firm CrowdStrike and severed its integrations to halt further unauthorized access to client information.

When reached by TechCrunch on Monday, Klue CEO Jason Smith did not provide an immediate response to inquiries about the event, including whether the company received any messages from the attackers such as a ransom demand.

Huntress, a security firm whose data was taken in the attack, noted in its account that the intruders sent a ransom message using an Australian company's email address, with servers apparently exploited for the operation.

Last June, Klue announced plans to reduce its workforce by roughly half, affecting around 100 employees, while emphasizing AI development. It is uncertain whether the staff cuts contributed to security shortcomings. Responsibility for cybersecurity at the company beyond CEO Smith is also unclear.

Klue currently does not identify any executive overseeing cybersecurity on its leadership page.