Threat actors compromised Klue’s Battlecards integration service accounts and used stolen OAuth tokens to extract customer records from connected Salesforce instances, without ever obtaining Salesforce credentials directly. Organizations that authorized Klue’s OAuth integration with Salesforce are potentially affected, including managed service providers (MSPs) confirmed impacted by Huntress’s independent investigation. The core business risk is unauthorized CRM data exfiltration through a trusted third-party channel, a supply chain attack vector that bypasses traditional perimeter controls.