KLUE BREACH TRACED TO UNREVOKED 2022 CREDENTIAL

The credential, which should have been deactivated after its pilot use ended, provided attackers with access to a system containing encryption keys for customer data. Klue has not explained why the credential remained active for over a year. The breach affected multiple customers, though Klue has not disclosed the full scope of compromised data or the number of affected users. The incident highlights a common security gap: credential management across organizations. Access keys from short-term projects or tests often persist longer than intended, creating entry points for attackers. Klue has not disclosed when the breach was discovered or how long attackers had access to the systems. The company has not yet detailed remediation steps or customer notifications beyond the initial disclosure. This follows a pattern of breaches stemming from forgotten or mismanaged legacy credentials that organizations fail to audit regularly.