Klue Data Breach Investigation Continues: OAuth Tokens Exposed

Klue, a private business-to-business software company based in Vancouver, Canada, disclosed a data breach involving unauthorized activity on its platform. Klue provides an AI-powered competitive enablement and win-loss analysis platform that helps product marketing and sales teams collect, organize and deliver intelligence about competitors.

Klue discovered the breach on June 22, 2026, and posted an update on its website describing the incident and the steps it has taken in response.

On April 5, 2026, Klue experienced unauthorized activity that affected part of the platform's integration systems. The breach resulted in the exposure of OAuth tokens, which function as digital keys that allow one application to securely access another on a user's behalf.

Because the platform connects various business systems, the exposure of OAuth tokens could potentially have provided access to a range of connected tools and the business data stored within them.

The company's notice confirmed that the incident affected customers and partners but did not specify how many were impacted.

Klue's response to the breach

After identifying the unauthorized activity, Klue rendered the affected credentials unusable and secured impacted data. The company also brought in third-party cybersecurity experts to assist with the investigation into the breach.

Klue conducted an investigation to determine the full scope and impact of the incident, which remains ongoing. The company has committed to communicate openly and transparently with their customers as the investigation continues.