OneTrust says notifications are complete after compromised integration credentials exposed CRM records, underscoring the need to define and verify third-party access.
OneTrust said on August 27 that it had concluded its response to the Klue incident. Its July 10 update had marked the technical investigation complete; required notifications were now finished.
According to OneTrust’s updates, compromised Klue integration credentials enabled unauthorized access to its Salesforce CRM on June 11–12. Exposed information included business contacts, CRM records and support-email records. The company reported no evidence that passwords, payment cards, customer OneTrust tenants or customer data processed within its platform were exposed.
OneTrust disabled the integration, revoked associated access and worked with external forensic specialists and Salesforce. The public updates identify neither the actor nor an affected-person count, and do not establish whether stolen copies remain.
Layer8’s Cybersecurity offering combines scoped assessment, prioritized remediation, agreed control implementation and acceptance checks. Applied to CRM integrations, that could mean recording each connection’s business purpose, limiting its permissions and assigning a named owner who can authorize changes or revocation. Such controls could reduce the reach of a compromised connection; their effectiveness depends on the permissions each platform can enforce.
An agreed check should confirm that approved access still works and that revoked access fails, with evidence retained by the responsible owner. Repeat the check after integration or permission changes. Removing a connection cannot retrieve previously copied records. Incident forensics and legal reporting require explicit scope. The useful deliverable is a tested access boundary with someone accountable for maintaining it.