Cambridge Mercantile Corp.

Corpay's own network stayed untouched; the exposure ran through Klue, the market intelligence platform wired into its CRM, where an unauthorized party sat inside the integration infrastructure for two days in June 2026. Names, email addresses, and physical addresses were pulled out of the vendor's side of that connection. Corpay never lost control of its network. It lost control of the security boundary the moment a third-party integration became a second entrance into its customer data.