Klue Faces Unprecedented Dual Extortion Attack After Data Breach
Vancouver-based market intelligence platform Klue has disclosed a rare and escalating cybersecurity crisis, involving two criminal groups with conflicting extortion demands following a data breach. The incident, first reported by TechCrunch, marks an unusual case of competing threats targeting the same victim highlighting evolving tactics in cyber extortion.
The breach initially involved a hacking group that stole sensitive customer data, including proprietary market research, competitive analysis, and strategic planning materials used by enterprise clients to track rivals. In a surprising turn, the original attackers later claimed they were deleting the stolen files, though Klue’s customers were warned not to assume the threat had passed. Before any relief could set in, a second criminal group emerged, demanding ransom for the same compromised data.
The situation leaves Klue’s enterprise clients including sales and marketing teams at major corporations in limbo, uncertain whether their highly sensitive business intelligence has been destroyed, leaked, or is now in the hands of multiple threat actors. The competitive intelligence sector handles particularly valuable data, such as go-to-market strategies and product roadmaps, which could cause significant damage if exposed.
Security researchers note that while secondary markets for stolen data are not new, the simultaneous, opposing claims from two criminal groups are highly unusual. The first group’s alleged data deletion could be a face-saving exit or genuine reversal, while the second group’s demands suggest they either independently accessed Klue’s systems or acquired the data from the original attackers.
Klue has not disclosed technical details of the breach, the scope of compromised data, or the number of affected customers. The incident underscores the cascading risks of B2B SaaS breaches, where third-party vendors handling critical business intelligence become high-value targets. It also arrives amid growing enterprise concerns over vendor security postures, following high-profile breaches at platforms like Okta and LastPass.
Source: https://www.techbuzz.ai/articles/klue-hit-by-double-extortion-as-second-hacker-group-emerges
Klue TPRM report: https://www.rankiteo.com/company/klue
"id": "klu1782428022",
"linkid": "klue",
"type": "Breach",
"date": "6/2026",
"severity": "100",
"impact": "5",
"explanation": "Attack threatening the organization's existence"{'affected_entities': [{'customers_affected': 'enterprise clients (sales and '
'marketing teams at major '
'corporations)',
'industry': 'market intelligence',
'location': 'Vancouver, Canada',
'name': 'Klue',
'type': 'B2B SaaS'}],
'customer_advisories': 'issued',
'data_breach': {'data_exfiltration': True,
'sensitivity_of_data': 'high',
'type_of_data_compromised': ['proprietary market research',
'competitive analysis',
'strategic planning materials',
'go-to-market strategies',
'product roadmaps']},
'description': 'Vancouver-based market intelligence platform Klue has '
'disclosed a rare and escalating cybersecurity crisis, '
'involving two criminal groups with conflicting extortion '
'demands following a data breach. The incident marks an '
'unusual case of competing threats targeting the same victim, '
'highlighting evolving tactics in cyber extortion. The breach '
'initially involved a hacking group that stole sensitive '
'customer data, including proprietary market research, '
'competitive analysis, and strategic planning materials. A '
'second criminal group later emerged, demanding ransom for the '
'same compromised data, leaving Klue’s enterprise clients '
'uncertain about the status of their sensitive business '
'intelligence.',
'impact': {'brand_reputation_impact': 'high',
'data_compromised': 'proprietary market research, competitive '
'analysis, strategic planning materials, '
'go-to-market strategies, product roadmaps'},
'motivation': ['financial gain', 'data extortion'],
'ransomware': {'data_exfiltration': True, 'ransom_demanded': True},
'references': [{'source': 'TechCrunch'}],
'response': {'communication_strategy': 'customer advisories issued'},
'threat_actor': ['hacking group 1', 'hacking group 2'],
'title': 'Klue Faces Unprecedented Dual Extortion Attack After Data Breach',
'type': ['data_breach', 'ransomware', 'dual_extortion']}