Data Analyst Intern

Ransomware: the average amount paid rises, while the median falls. The average ransom paid increased quarter over quarter, while the median amount declined. This is notably due to a malicious actor focusing on law firms. Published on: July 30, 2026 On the ransomware front, the second quarter of 2026 brings a surprise. The average ransom amount rose 176% compared to the first quarter, reaching $1,880,612, while the median amount fell 50% to $150,000. The explanation? An unusual one: a ransomware group that chose to select its victims very meticulously, Silent Ransom Group. Also tracked under the name Luna Moth, this group focuses exclusively on law firms. By threatening to publicly disclose sensitive legal files, the group obtained large sums that significantly skewed the quarterly average, according to Coveware. At the same time, victims' awareness of the volatility of post-payment outcomes is on the rise. Victims recognize that payment does not guarantee data deletion. The attack against Klue in June illustrates this fragility: after a supposed payment to guarantee deletion, it turned out that another criminal group had kept the data and the victims' names, thus maintaining a persistent extortion threat. This risk had already been identified in the past, notably with LockBit. Identity as a privileged access vector. Initial access to information systems has evolved from a reliance on automated technical exploits to a strong reliance on identity. Attackers now favor access paths that seem legitimate, seeking to log in discreetly rather than force a noisy intrusion. The abuse of trusted identities is the dominant trend. Sophisticated social engineering methods, notably vishing, are frequently used to trick employees into obtaining credentials or remote access. In more aggressive operations, malicious actors have even carried out physical infiltration, posing as IT staff to gain direct access to workstations. The intrusion vector has thus expanded beyond simple VPN or RDP. It encompasses the abuse of legitimate authentication flows: password resets, helpdesk manipulation, OAuth grants, delegated applications, remote access portals, and third-party vendor sessions. The initial intrusion often resembles normal authentication or authorized administration, which complicates early detection. The victim profile remains focused on the mid-market. The professional services sector, including law firms, is particularly vulnerable due to the sensitive nature of client information they hold. Coveware notes that company size is not a reliable indicator of extortion risk; exposure is more linked to identity compromise, data sensitivity, and third-party dependencies.

Hackers hack hackers in bizarre data theft. Posted by ironsideit On July 27, 2026 Most businesses spend time protecting their own networks, but what about the vendors that have access to your data? Whether it's your CRM, payroll provider, document management platform, or marketing software, every third-party application you connect to your business becomes part of your cybersecurity strategy. A recent breach involving competitive intelligence platform Klue is a reminder that your organization's security is only as strong as the weakest vendor in your technology ecosystem. What happened? According to reports, the cybercriminal group known as Icarus gained access to Klue using an old login associated with a pilot project that had never been removed. Once inside, the attackers stole OAuth tokens - digital credentials that allow connected applications to access other business systems without repeatedly asking users to log in. Those tokens reportedly provided access to customer data connected through third-party integrations, including Salesforce environments used by some Klue customers. In an unusual twist, another cybercriminal group then compromised Icarus itself and stole the stolen data, launching a second round of extortion attempts. While the story is unusual, the underlying lesson is not. Old accounts, forgotten integrations, and excessive permissions remain some of the most common ways attackers gain access to business systems. Why this matters to every business. Even if your company has never used Klue, you're likely connected to dozens - or even hundreds - of third-party applications. Examples include: * Microsoft 365 * Salesforce * HubSpot * QuickBooks * DocuSign * Zoom * Dropbox * Slack * Payroll providers * Industry-specific business applications Each integration creates another pathway into your environment. If one vendor experiences a security incident, your business could also be affected depending on the level of access you've granted. This is why cybersecurity is no longer just about protecting your own network. It's also about understanding and managing third-party risk. The hidden risk of forgotten accounts. One of the most concerning details from the Klue breach is that the attackers reportedly used an old credential tied to an abandoned project. This happens more often than many businesses realize. Former employees, old test accounts, pilot projects, and unused integrations frequently remain active long after they've been forgotten. Every unused account represents another opportunity for attackers. Regular account reviews help identify: * Former employee accounts * Shared logins * Test environments * Legacy applications * Unused integrations * Excessive user permissions Removing unnecessary access is one of the simplest ways to reduce cyber risk. Many businesses connect applications to Microsoft 365, Salesforce, Google Workspace, and other cloud platforms with just a few clicks. Over time, these integrations accumulate. Ask yourself: * Does this application still need access? * Does it require this level of permission? * Who approved the connection? * When was it last reviewed? Applications should only have the minimum permissions necessary to perform their intended function. Strengthen your vendor security strategy. Reducing third-party risk starts with visibility. Some best practices include: * Maintain an inventory of software vendors and integrations. * Remove unused applications and inactive accounts. * Require multi-factor authentication (MFA) wherever possible. * Regularly review OAuth permissions. * Monitor for unusual login activity. * Ask vendors about their cybersecurity practices before sharing sensitive information. * Include third-party risk reviews as part of your annual cybersecurity assessment. These simple steps can significantly reduce your organization's exposure. Cybersecurity doesn't stop at your front door. Today's businesses rely on dozens of technology vendors every day. While these tools improve productivity, they also expand your attack surface. The Klue incident is another reminder that cybercriminals are constantly looking for overlooked accounts, excessive permissions, and trusted third-party connections to gain access to valuable business data. A proactive cybersecurity strategy includes protecting not only your own systems but also understanding the risks introduced by every vendor you trust. Is your business managing third-party risk? At Ironside IT, Ironside IT help businesses throughout South Jersey, the Greater Philadelphia area, and Delaware identify security gaps, secure Microsoft 365 environments, review third-party integrations, and build layered cybersecurity strategies that reduce risk. If you're unsure how many applications have access to your business data - or whether those permissions are still necessary - now is a great time to take a closer look.

When the hackers get hacked: The Klue breach and the new reality of third-party cyber risk. Jul 27, 2026 8 mins A strategic overview of the Klue compromise for cybersecurity, risk management and executive leadership professionals. In cybersecurity, defenders sometimes naively assume that threat actors operate from secure, resilient infrastructures insulated from the very chaos they inflict on others. The 2026 compromise of Klue challenges that assumption. What began as a software-as-a-service supply chain breach evolved into an exceptional case in which a second criminal group claimed to have compromised the first extortion crew and pilfered data that had already been stolen. The result was not simply another ransomware story. It exposed fundamental weaknesses in SaaS integrations, identity-based trust, third-party risk management and executive decision-making. Scene of the crime. Founded in 2015, Klue, a Vancouver, British Columbia-based software-as-a-service (SaaS) company, provides an AI-powered competitive intelligence platform that serves more than 500 customers and employs more than 200 people across North America and Europe. The company has raised approximately $81 million in venture funding. The platform helps organizations monitor competitors, analyze market signals and distribute insights across sales, marketing, product and executive teams. By aggregating public sources, internal knowledge, and third-party data, Klue turns fragmented information into actionable intelligence that supports faster strategic decisions, stronger competitive positioning, and more effective product planning. Klue's "Battlecards app" integrates with Salesforce, HubSpot, SharePoint, Zoom, Gong, Chorus, Clari, Google Drive and Slack, syncing account records, deal data, contact information and call transcripts. Cause of the breach. Klue occupies a privileged position within customer environments since it integrates with platforms such as Salesforce and other collaboration ecosystems. Those integrations rely heavily on OAuth tokens that permit trusted, authenticated access without repeatedly requesting credential inputs. Attackers from the Icarus criminal group discovered an unused but still-active service account credential originally created for a pilot project. That unused, forgotten credential provided an entry point into Klue's integration infrastructure. Rather than stealing passwords, the attackers harvested OAuth tokens. This distinction matters. Modern identity-based attacks increasingly focus on session tokens and application trust relationships instead of credential theft. Once valid OAuth tokens were obtained, the attackers effectively inherited the permissions granted to Klue within customer environments. They executed extensive Salesforce API queries over a period of hours, extracting customer relationship management data including contact information, quotes, pricing information, sales communications and account records. Continuance of the breach. The most unusual aspect of the incident emerged after the initial compromise. Icarus allegedly informed Klue that another criminal group had obtained sample data after compromising Icarus' servers. That second group reportedly attempted to directly extort affected organizations independently while advising victims not to trust Icarus. Whether every claim can ultimately be verified is less important than the strategic lesson it illustrates. Stolen data can itself become a target inside criminal ecosystems. This development fundamentally alters the traditional ransomware decision model. Organizations have long debated whether paying a ransom increases the likelihood that stolen information will remain private. But the Klue breach illustrates an even more troubling possibility. Even if an organization believed the original attackers would honor an agreement to delete stolen information, the criminals may no longer control the data. If threat actors maintain poor operational security, expose infrastructure or suffer compromises themselves, victims may face repeated extortion campaigns despite paying the initial demand. CISO perspective. From a CISO perspective, this incident reinforces an uncomfortable reality: identity has become the new perimeter. Security investments focused exclusively on endpoint protection or network segmentation provide little protection when a trusted SaaS application already possesses legitimate access to enterprise data. The breach also demonstrates how seemingly insignificant technical oversight becomes enterprise risk. The root cause was not an advanced zero-day exploit. Instead, an inactive credential remained enabled years after its intended purpose had ended. Security professionals routinely discuss attack surface reduction, yet dormant service accounts, forgotten API keys and obsolete integrations continue to exist inside many organizations. CSO smart answers. Explore related questions. Governance failures frequently create greater exposure than sophisticated malware. Klue reportedly detected suspicious activity quickly, revoked credentials, removed malicious code and engaged incident response specialists and law enforcement. These actions reflect mature incident response processes. Nevertheless, the downstream impact extended well beyond Klue because customers had delegated trusted access to the platform. The compromise therefore became a supply-chain event in which one vendor's security weakness propagated risk across numerous downstream organizations. Executive perspectives. For executive leadership, the incident raises broader governance questions. Vendor risk assessments often emphasize compliance certifications, questionnaires and contractual commitments. Far less attention is devoted to lifecycle management of privileged service accounts, continuous credential governance or monitoring of delegated application permissions. Executives should ask whether critical SaaS providers regularly eliminate dormant credentials, rotate secrets and continuously validate privileged integrations rather than relying solely on annual audits. Executives therefore should recognize that ransom payments cannot reliably purchase exclusivity or certainty. Cyber extortion increasingly resembles a fragmented marketplace in which multiple actors may possess copies of the same information. Risk decisions should be evaluated with that possibility explicitly acknowledged. Several practical lessons emerge: * Organizations should inventory every SaaS integration possessing privileged API access and regularly validate business justification. * Privileged service accounts require formal ownership, expiration policies and automated deprovisioning. * OAuth tokens deserve the same governance attention historically applied to passwords and certificates. * Organizations should continuously monitor abnormal API behavior capable of revealing high-volume data extraction. In the Klue breach, Icarus attackers were allegedly executing approximately 1,000 queries within a fifteen-minute timeframe against one environment. * Third-party risk programs should evaluate operational security practices surrounding identity governance rather than treating compliance certifications as sufficient evidence of resilience. Board of director perspective. Boards also should broaden the metrics they receive from security leadership. Instead of measuring only phishing click rates or vulnerability counts, executives should understand how many privileged SaaS integrations exist, how many dormant service accounts remain active, how frequently application permissions are reviewed, and how rapidly suspicious API activity can be detected and contained. These indicators more directly reflect organizational exposure in cloud-centric environments. The Klue incident represents more than just another breach. It demonstrates that modern enterprises inherit both the strengths and weaknesses of every trusted integration within their digital ecosystem. It also reveals that cybercriminal organizations are neither unified nor necessarily competent custodians of stolen information. When attackers become victims themselves, organizations discover that extortion risk does not end with the initial compromise. Afterthoughts. * As identified on the Ransomware Live website, Icarus is a relatively new ransom group whose criminal activity was first identified in May 2026. To date, they have victimized twelve entities across three countries: the United States, Canada and Indonesia. Csoonline may not know the entirety of the blast radius caused by the Klue breach, but it is significant, with allegedly 195 victims. * For this article, I accessed Klue's impressive Trust Center. Klue boasts badges for SOC 2, GDPR and CCPA compliance. Additionally, Klue identifies nearly 50 security controls spread across infrastructure security, organizational security, product security and internal security procedures. The Klue Trust Center also provides a notice dated May 6, 2026, announcing that they completed their SOC 2 Type 2 audit for the period of March 16, 2025, to March 15, 2026. It should be noted that SOC 2 Type 2 compliance should be audited and renewed on an annual basis. According to Klue's update, they are not SOC 2 Type 2 compliant. * In reviewing Klue's Leadership website page, there is no one identified on the team with a CISO title. I also conducted a LinkedIn and internet search and I could not find a Klue employee with a CISO or similar title responsible for enterprise cybersecurity. For CISOs, executives and boards, the lesson is straightforward. Trust relationships require continuous governance, identity is now a primary attack surface and organizations must assume that once data leaves their control, no criminal promise can restore certainty. In an era where even hackers can be hacked, resilience - not misplaced trust - remains the only sustainable defense.