Major Cyberattack at Klue: Hackers Gained Access via 2022 Credentials

Klue, a market analysis company, has officially confirmed a major cyberattack caused by outdated access credentials dating back to 2022. Due to this security flaw, hackers managed to obtain confidential information of many corporate clients, including world-renowned cybersecurity organizations. This was reported by Techcrunch.com news states.

Although the Vancouver-based company Klue detected the attack on June 12, the details are only now being disclosed. It appears that hackers used an access key provided to a third party for a limited pilot project in 2022. This situation has raised serious questions about the weakness of the company's security system and its processes for timely deletion of outdated data.

Cybersecurity Giants Targeted

The fact that the victims include the popular password manager LastPass and several large cybersecurity firms demonstrates the severity of the situation. By stealing special keys called OAuth tokens from the Klue system, hackers gained access to clients' other cloud storage repositories and databases.

In an interview with TechCrunch, Klue representative Katie Berg stated that the stolen data belonged to a third party, but did not disclose which partner or project was involved. Furthermore, it remains unclear why this access credential was not revoked after the pilot project ended.

Investigation and Future Measures

The company is currently describing the incident on its blog as the theft of "legacy credentials related to an integration service." Experts believe that if Klue had removed these outdated credentials from the system in a timely manner, such a large-scale data leak could have been prevented.

The company announced that it is currently conducting a comprehensive review in the following areas:

• Reviewing the access credential management system;
• Strengthening control mechanisms for external vendors;
• Expanding system monitoring capabilities;
• Optimizing security implementation processes.

This event should serve as an important lesson for IT professionals and the corporate sector in Uzbekistan. Outdated logins and passwords, especially temporary credentials granted for third-party projects, often become the weakest point. The fact that a major international platform like Klue made such a mistake proves once again how vital the principle of "constant vigilance" is in digital security.