Most businesses spend time protecting their own networks, but what about the vendors that have access to your data?
Whether it's your CRM, payroll provider, document management platform, or marketing software, every third-party application you connect to your business becomes part of your cybersecurity strategy.
A recent breach involving competitive intelligence platform Klue is a reminder that your organization's security is only as strong as the weakest vendor in your technology ecosystem.
What Happened?
According to reports, the cybercriminal group known as Icarus gained access to Klue using an old login associated with a pilot project that had never been removed.
Once inside, the attackers stole OAuth tokens—digital credentials that allow connected applications to access other business systems without repeatedly asking users to log in.
Those tokens reportedly provided access to customer data connected through third-party integrations, including Salesforce environments used by some Klue customers.
In an unusual twist, another cybercriminal group then compromised Icarus itself and stole the stolen data, launching a second round of extortion attempts.
While the story is unusual, the underlying lesson is not.
Old accounts, forgotten integrations, and excessive permissions remain some of the most common ways attackers gain access to business systems.
Why This Matters to Every Business
Even if your company has never used Klue, you're likely connected to dozens—or even hundreds—of third-party applications.
Examples include:
- Microsoft 365
- Salesforce
- HubSpot
- QuickBooks
- DocuSign
- Zoom
- Dropbox
- Slack
- Payroll providers
- Industry-specific business applications
Each integration creates another pathway into your environment.
If one vendor experiences a security incident, your business could also be affected depending on the level of access you've granted.
This is why cybersecurity is no longer just about protecting your own network. It's also about understanding and managing third-party risk.
The Hidden Risk of Forgotten Accounts
One of the most concerning details from the Klue breach is that the attackers reportedly used an old credential tied to an abandoned project.
This happens more often than many businesses realize.
Former employees, old test accounts, pilot projects, and unused integrations frequently remain active long after they've been forgotten.
Every unused account represents another opportunity for attackers.
Regular account reviews help identify:
- Former employee accounts
- Shared logins
- Test environments
- Legacy applications
- Unused integrations
- Excessive user permissions
Removing unnecessary access is one of the simplest ways to reduce cyber risk.
Review Third-Party Access Regularly
Many businesses connect applications to Microsoft 365, Salesforce, Google Workspace, and other cloud platforms with just a few clicks.
Over time, these integrations accumulate.
Ask yourself:
- Does this application still need access?
- Does it require this level of permission?
- Who approved the connection?
- When was it last reviewed?
Applications should only have the minimum permissions necessary to perform their intended function.
Strengthen Your Vendor Security Strategy
Reducing third-party risk starts with visibility.
Some best practices include:
- Maintain an inventory of software vendors and integrations.
- Remove unused applications and inactive accounts.
- Require multi-factor authentication (MFA) wherever possible.
- Regularly review OAuth permissions.
- Monitor for unusual login activity.
- Ask vendors about their cybersecurity practices before sharing sensitive information.
- Include third-party risk reviews as part of your annual cybersecurity assessment.
These simple steps can significantly reduce your organization's exposure.
Cybersecurity Doesn't Stop at Your Front Door
Today's businesses rely on dozens of technology vendors every day.
While these tools improve productivity, they also expand your attack surface.
The Klue incident is another reminder that cybercriminals are constantly looking for overlooked accounts, excessive permissions, and trusted third-party connections to gain access to valuable business data.
A proactive cybersecurity strategy includes protecting not only your own systems but also understanding the risks introduced by every vendor you trust.
Is Your Business Managing Third-Party Risk?
At Ironside IT, we help businesses throughout South Jersey, the Greater Philadelphia area, and Delaware identify security gaps, secure Microsoft 365 environments, review third-party integrations, and build layered cybersecurity strategies that reduce risk.
If you're unsure how many applications have access to your business data—or whether those permissions are still necessary—now is a great time to take a closer look.
