Neon One Klue Breach Shows Donor Data Risk

Neon One has started notifying people about a breach tied to Klue, a third party software vendor that provided an integration service for its Salesforce customer relationship management environment. The latest public summaries were published on 4 August 2026, which puts this incident inside the daily breach alert window for the current India date.

The important point for TPRM analysts is not only that personal information was accessed. The bigger lesson is that donor and constituent data can be reached through connected SaaS apps, not just through the main system where the data lives.

What Happened

Neon One linked the notice to Klue

Public notice summaries say Neon One became aware on 16 June 2026 of a cybersecurity incident at Klue. Klue provided an integration service connected to Neon One Salesforce customer relationship management data. Unauthorized access to certain personal information reportedly occurred from 11 June to 12 June 2026.

Klue described the root issue

Klue says it identified unauthorized activity affecting part of its integration infrastructure on 12 June. Its investigation found that an attacker used a compromised legacy credential tied to an integration service. Klue says the attacker used that access to obtain OAuth tokens that connected Klue with certain outside platforms, including Salesforce.

What Data Or Systems Were Affected

Personal information was accessed

The public Neon One summaries confirm access to personal information. The exact data fields are not fully public. One summary says affected individuals received details in their own notices, while another says names and other personal information were involved.

The affected path was an integration path

Klue says the incident affected connected customer environments through outside platforms, and that it found no evidence that customer content stored inside the Klue platform itself was impacted. That distinction matters. A vendor can still create exposure when its integration tokens open a route into another system.

The Third Party Angle

Nonprofit data often sits in connected workflows

Neon One provides fundraising, donor management, event, and operational software for nonprofit organizations. In that environment, data may move between donor platforms, Salesforce, payment workflows, marketing systems, reporting tools, and partner services. A single connected app can become a path into records that many teams assumed were protected by the main platform.

OAuth access needs vendor level review

ReliaQuest says a compromised Klue integration was used to pull Salesforce customer relationship management data through OAuth tokens and automated REST API queries. It also said attribution is still unknown. For analysts, that means the useful control question is practical. Which vendor apps have tokens, what can they read, and how quickly can those tokens be revoked?

Practical Protection Steps

For TPRM analysts

Start with a map of SaaS integrations that touch donor, customer, sales, or constituent data. Do not stop at the main application owner. Include enrichment tools, enablement tools, email tools, reporting tools, file sharing tools, and old pilots that may still have active credentials.

For business owners

Ask each system owner to confirm which connected apps can read records, export records, create tokens, or run API queries. Pay special attention to legacy connections that are no longer used by the business but still have access.

Practical Checklist

1. List every vendor app connected to Salesforce and other donor data systems
2. Find legacy integrations that are active but no longer needed
3. Review OAuth scopes for read access, export access, and administrator access
4. Revoke tokens for unused apps and rotate credentials for active apps
5. Check logs for unusual API query volume and large record exports
6. Confirm whether vendor service accounts use strong authentication and named ownership
7. Ask vendors how they protect integration secrets and legacy credentials
8. Check whether incident notices cover suspected token theft as well as confirmed data access
9. Update vendor risk records when an integration can reach sensitive donor or customer data
10. Document data fields that are verified, fields that are unknown, and owners for follow up

Analyst Takeaway

This breach is a reminder that connected apps are part of the supplier attack surface. For TPRM teams, the control is not just vendor due diligence at onboarding. It is continuous inventory, least privilege access, token monitoring, and fast revocation when a third party integration becomes risky.

FAQ

What happened in the Neon One breach

Neon One notified people after a Klue vendor incident reportedly led to unauthorized access to certain personal information connected to its Salesforce customer relationship management environment.

When did the unauthorized access happen

Public summaries say the unauthorized access occurred from 11 June to 12 June 2026, and Neon One became aware on 16 June 2026.

What data was affected

The public summaries confirm personal information was accessed. The exact fields are not fully public, so analysts should avoid assuming more detail than the notices verify.

Why is this a third party risk issue

The incident involved Klue, a third party software vendor, and an integration path into Salesforce data. That makes SaaS connections, OAuth scopes, token handling, and vendor notice duties central to the review.

What should TPRM analysts do now

Analysts should inventory connected apps, remove stale integrations, review OAuth scopes, hunt for unusual API activity, and confirm how vendors protect integration credentials.

Sources

• Claim Depot Neon One summary
• Class Action U Neon One summary
• Klue incident update
• ReliaQuest Klue analysis
• Huntress Klue incident report