Deel

Documented events with consequences still open. Each entry carries a source and a date.

1. Jun 17, 2026 Data breach Moderate ● open

   Unauthorised access to Deel's CRM through third-party vendor Klue's integration: contact and commercial data of customers and partners exposed, plus “a very limited amount of personal data”. The platform and payroll/HR data are not involved; the number of people affected has not been disclosed

   On 17 June 2026 Deel confirmed that an unauthorised party had accessed contact and commercial information held in its CRM. The public notice came on 26 June 2026 on the official blog. The access did not go through the Deel platform: it happened — in the company's words — “through a compromised connection with Klue, a third-party software provider that integrated with our CRM”. WHAT GOT OUT. Deel describes the material as “public, business contact, and commercial” information used by its sales and marketing teams: names, business email addresses, job titles, phone numbers and business details. To these the company adds, in its own words, “a very limited amount of personal data synced to our CRM”: that “very limited” is not quantified, and neither is the number of customers or partners involved. The platform, payroll and the HR data of workers managed through Deel are not reported as affected. WHAT DEEL DID. Disconnected the vendor and revoked its access, revoked active user sessions and removed older access tokens, engaged independent cybersecurity experts to validate the investigation, engaged external counsel, increased monitoring across systems, engaged with the relevant data protection authorities and set up a dedicated mailbox (klue-response@deel.com). The page states it will be updated as the investigation progresses. ⚠️ WHY IT MATTERS MORE THAN THE WORD “B2B” SUGGESTS. This is professional contact data belonging to the people who handle contracts and payroll: exactly the material needed to build a credible payment request. Deel says so itself, advising recipients to be wary of unexpected communications referencing Deel, their organisation, contracts, invoices, account information or payment requests, and not to change payment instructions without independent verification. ⚠️ Third-party phishing is not an incident of the provider — but here the risk stems from a data leak at the provider, and it is the provider itself that discloses it. THE UPSTREAM CAUSE, NOW DOCUMENTED BY KLUE (verified 28/9/2026). Deel had referred generically to “a compromised connection”. The vendor has now published its own account: Klue says it identified unauthorised activity in its integration infrastructure on 12 June 2026, where an attacker exploited “a compromised legacy credential associated with an integration service” to obtain OAuth tokens, and used those tokens to reach connected customer environments — Salesforce among them. Klue states that content stored inside its own platform was not impacted, engaged CrowdStrike for the investigation, involved law enforcement, and calls the event “a deliberate criminal act”. Neither company has published a number of affected customers. ⚠️ AND IT IS NOT AN ISOLATED CASE: DEEL IS ONE VICTIM AMONG MANY. That was the question left open by the previous run, and the answer is yes. The Klue incident is a multi-victim supply-chain compromise: OneTrust, Recorded Future, Huntress, Jamf and LastPass, among others, have each published their own notice. Two practical consequences for anyone using Deel. First, the mechanism is not a stolen Deel password, it is OAuth tokens belonging to an integration — access that was already authorised and keeps working until someone revokes it; if your organisation connects third-party tools to its CRM, that is the surface to review, not the password. Second, data on the same victim may have left through several vendors in the same period, so an attempted scam can appear better informed than Deel's own notice alone would suggest. STATUS. `risolto: false`: the compromised connection was closed and tokens revoked, but data that has left cannot be pulled back, the count of people affected has not been published and the investigation is declared ongoing. `in_corso: false`: no access is reported to be still under way.

   ↗ source

verified on Sep 28, 2026

Weighted average across 2 public review platforms (12,192 reviews in total), weighted by volume. This is not our rating: it is those platforms’ average.