Klue Confronts Security Concerns After Hackers Exploit 2022 Credential

A recent cyberattack on market research company Klue has raised significant concerns about the firm's security practices. Hackers used a credential dating back to 2022 to steal sensitive data from several of Klue's corporate customers, including prominent cybersecurity companies like LastPass. The credential, which was initially provided to a third-party for a limited pilot, was somehow compromised and used to access Klue's systems, allowing the hackers to download valuable data and extort the companies. Klue's investigation into the incident is ongoing, but the company has acknowledged that the credential was not revoked after the pilot concluded, leaving it vulnerable to exploitation.

This has sparked questions about Klue's security posture and what measures it could have taken to prevent the breaches. The hacking group Icarus has claimed responsibility for the attack and is threatening to release the stolen data unless its ransom demands are met. Klue has stated that it is conducting a comprehensive review of its credential management and security processes, but the company has not provided further details on the incident or its response to the hackers' demands. As the situation continues to unfold, it remains to be seen how Klue will address the concerns of its customers and the broader security community.

Source: TechCrunch