SEC Form 8-K Item 1.05 (material cybersecurity incidents) Primary notice
Disclosed in a 8-K filed June 23, 2026, as listed by the SEC Form 8-K Item 1.05 (material cybersecurity incidents).
- Organization as reported
- 8X8 INC /DE/, CA
- Category as reported
Item 1.05 Material Cybersecurity Incidents
- Notice date as reported
- June 17, 2026
- Filing date
- June 23, 2026
- Observed by BreachRecords
- 2026-10-18 20:34 UTC (revision 8096, doc:eght-20260617.htm)
- Archived copy
- Held in the private archive (provenance)
Material Cyber Security Incident. On June 13, 2026, 8x8, Inc. (the “Company” or “we”) was informed that an unauthorized third party threat actor exploited the Klue Labs, Inc. (“Klue”) third-party application programming integration connected to the Company's Salesforce, Inc. (“Salesforce”) customer relationship management system. The threat actor gained unauthorized access and exfiltrated certain information from 8x8’s Salesforce system. This unauthorized access occurred between June 11 and 12, 2026. Upon discovery, 8x8 and Klue, with support from Salesforce, took immediate steps to disable the compromised integration and removed the unauthorized access. The threat actor exfiltrated certain competitively sensitive information about current, former and prospective customers of the Company, including fragmented contract and opportunity information, sales team notes, and contact information (names, business addresses, phone numbers and email addresses of the customers). Our investigation to date indicates that this incident was isolated to information stored in 8x8’s Salesforce system that was accessible through the Klue integration. The Company has and continues to implement additional security measures to reduce the risk of similar unauthorized access in the future. As of the date of this report, other than the Company’s response and remediation activities, the incident has not had an impact on the Company’s business or operations. The Company’s ability to serve customers has not been impacted, and its information systems remain operational and undisrupted. We continue to investigate the extent of the incident including examining the information accessed. We are in the process of notifying the relevant regulatory authorities with respect to the unauthorized access. While the Company has determined this incident is reportable under