Here’s something that you should pay attention to. Market intelligence platform Klue suffered a OAuth breach. That is back. But via a blog post it is much worse.
On June 12, we identified unauthorized activity affecting a portion of Klue’s integration infrastructure. Since then, we’ve been working alongside trusted cybersecurity experts to understand what happened, support our customers, and restore the connections you rely on. Our investigation determined that an attacker gained access through a compromised legacy credential associated with an integration service. The attacker used that access to obtain OAuth tokens used to connect Klue with certain third-party platforms, including Salesforce, and subsequently accessed data within a number of connected customer environments. Based on our investigation to date, the incident was limited to the affected third-party platforms, and there is no evidence that customer content stored within the Klue platform was impacted. We recognize that customers rely on Klue to securely connect to their systems, and we understand the seriousness of that responsibility.
Since then, several companies have come forward to confirm they had data stolen during the attack, including Gong, Jamf, HackerOne, Insurity, OneTrust, Recorded Future, Snyk, Sprout Social, and Tanium. The growing list of cybersecurity firms disclosing the impact from the this hack is a striking data point: These are organizations that build security for a living, ran standard vendor assessments, and still got caught in the blast radius. That’s not a failure of due diligence. That’s a failure of due diligence to actually measure.
Justin Beals, CEO & Founder, Strike Graph, an AI-native GRC and compliance automation platform had this to say:
“Cybersecurity vendors getting breached through a shared SaaS dependency is the clearest possible signal that the questionnaire model of third-party risk is broken. These are companies that build security for a living. They did their due diligence. It didn’t matter, because due diligence in TPRM today is still mostly measuring what vendors say about themselves, not what their controls actually do. Traditional TPRM tools have true positive detection rates below 30%. That’s not a risk management program. That’s a paper trail. The Klue incident is going to keep expanding because the underlying failure, trusting attestations over verified evidence, is industry-wide. Until organizations move from point-in-time assessments to continuous, evidence-validated controls across their vendor ecosystem, the blast radius of the next shared dependency breach is going to be just as wide.”
Seeing as you are only as secure as the guy you work with, you have to take your time and put a whole lot of effort into maintaining security. Otherwise this because more of the norm rather than the exception.
FortiBleed – New SOCRadar In-Depth Technical Analysis Published
Posted in Commentary with tags FortiBleed on June 22, 2026 by itnerdAfter several days spent reverse-engineering the attacker’s environment, the SOCRadar research team has published a new, in-depth technical analysis on the FortiBleed campaign, including the attacker’s infrastructure, tooling, and methods.
Summary:
FortiBleed is a large-scale, still-active credential-harvesting campaign targeting internet-facing Fortinet FortiGate firewalls — hundreds of thousands of devices in scope worldwide. It is important to state plainly what it is not: this is not a zero-day or a newly disclosed software vulnerability. It is a credential and access operation. Attackers compromise exposed firewalls, harvest the authentication traffic and credentials passing through them, crack what they capture, and sell that access on. The actor fits the profile of a financially-motivated initial access broker — the kind whose intrusions become the front end of someone else’s ransomware or data-extortion event.
Why it matters — and the number to focus on. At the time of writing, more than 19,000 FortiGate devices were still being actively sniffed by the attackers — part of a broader 80,553 identified targets. That present tense is the point: this is not a historical data dump to clean up after, but a live operation, running since at least February 2026, quietly capturing authentication traffic as users log in each day. Because the firewall sits at the network edge, a compromise there can expose an organization’s entire identity layer — and the campaign reaches deep into supply chains, since MSPs and IT-services firms that manage Fortinet devices for others are squarely in the targeting.
What’s new in this report:
What goes deeper: The report maps the full attack chain end to end — reconnaissance, initial access, credential cracking, lateral movement into Active Directory, and exfiltration — with indicators of compromise, file hashes, a MITRE ATT&CK mapping, and the attribution clues pointing to a Russian-speaking access broker.
What it corroborates: Several findings independently align with other published research, which we think is worth noting rather than glossing over: the Sophos figure (~247,584) matches what others observed, as do the scale of the MSSQL brute-forcing and the confirmed deep intrusion at a defense contractor. Where the picture is still uncertain — full attribution, for instance — is noted as well.
To view the full report, see Dismantling FortiBleed: Inside a Russian Fortinet Compromise Operation
Leave a comment »