LastPass has confirmed that customer personal information was stolen in a supply chain attack against Klue, a third-party market intelligence platform its go-to-market teams used and had integrated with Salesforce and Gong. The company says it learned of the incident on June 12, 2026, when Klue disclosed that attackers had used compromised credentials tied to legacy integrations to reach its systems. Attackers obtained OAuth tokens Klue held on behalf of its customers, then used the LastPass token to query and exfiltrate CRM data from the company's Salesforce environment. LastPass has been consistent on the boundary: password vaults, master passwords, and core product infrastructure were not touched. No source in this set publishes a count of affected LastPass customers, and the company has not disclosed one.
What Happened
Accounts of the intrusion window converge tightly. SecurityWeek reports the attack unfolded between June 11 and June 12, with the intruders using compromised legacy credentials to access Klue, harvest OAuth tokens for customer integrations, and pull data in bulk. Salesforce disabled the Klue integration on June 17 and, per SecurityWeek's reporting, had not re-enabled it at time of writing; Gong disabled its integration as well.
Disclosure dates differ slightly across outlets and are worth stating rather than smoothing over. UpGuard logs the breach as discovered June 12 and reported June 22. InvideLabs dates the LastPass confirmation to June 23. ZDNET points to a Tuesday blog post from LastPass, in a story filed June 24. The likeliest reading is a staged disclosure, with an initial notice around June 22 and 23 followed by direct customer emails later that week, which is when Protos (via BitRss) says LastPass emailed its users. Treat the exact publication date as approximate.
The blast radius extends well past LastPass. SecurityWeek reports roughly two dozen Klue customers have confirmed their Salesforce instances were compromised, naming AlertMedia, Blackbaud, Camunda, Cresta, Deel, Lucanet, Link11 and Tines among them, while cautioning that Klue has hundreds of customers and that it has not seen notifications from others. SecurityWeek also relays a claim that the incident allegedly affects 195 Klue customers. InvideLabs lists a partial victim roster including HackerOne, Recorded Future, Tanium, Gong, Jamf, Snyk, OneTrust, Sprout Social and Huntress. Note the irony flagged in SecurityWeek's headline: several of the downstream victims are themselves security vendors. Not every Klue customer was exposed. SecurityWeek notes Autodesk, for example, may not use the Salesforce integration and was not affected.
What Was Taken
The exposed data set is described almost identically across LastPass's own statements as relayed by ZDNET, InfoSec Today, InvideLabs, TMC Insight and Protos: customer names, phone numbers, email addresses, physical addresses, customer support case data, and sales-related CRM records. UpGuard's summary lists names, emails, phone numbers and physical addresses and rates the incident medium severity. TMC Insight's phrasing narrows the last category to "sales-related case records." The substantive difference between these accounts is minimal.
There is no published volume figure. No source in this set gives a record count, an affected-customer count, or a data size for the LastPass portion. Anyone citing a number for this breach is going beyond what has been disclosed.
Sensitivity is the key judgment call. This is business contact and support data, not credential material. LastPass stated there is no evidence the attacker accessed data from Gong, the other service connected through Klue, per InvideLabs. But support case data is not inert: it can contain account context, product configuration details, and the substance of prior interactions with LastPass support, all of which sharpen a pretext call considerably.
Why It Matters
The direct technical impact is contained. The reputational and downstream-risk impact is not, and the two should not be confused.
LastPass customers are, by definition, people who consolidate secrets in one place. Pairing a verified list of password manager users with names, phone numbers, and prior support history hands an extortion crew an unusually well-qualified target list for vishing and smishing that impersonates LastPass support. The 2022 vault breach is the reason this matters more here than at a typical CRM exposure. Protos notes that crypto investigator ZachXBT tied roughly $4.4 million drained from over 25 victims in 2023 and $5.4 million from over 40 addresses in 2024 to that earlier incident, and reports the claim that Ripple co-founder Chris Larsen lost $150 million in crypto after private keys were exposed in it. Those figures come from an OTHER-tier source relaying third-party research and should be read as reported claims, not as confirmed attribution. They still explain why LastPass users are a premium phishing audience regardless of what was in this particular data set.
Attribution is where the sources genuinely diverge. Protos, SecurityWeek, InvideLabs and TMC Insight all name the Icarus extortion group, which SecurityWeek says added Klue and several customers to a Tor leak site and which InvideLabs describes as active only since late April 2026. UpGuard, by contrast, states the incident "did not involve a named threat actor at this time" and that the cause has not been identified. UpGuard's entry appears to reflect the state of LastPass's own disclosure, which did not name an actor, while the press reporting reflects Icarus's public claim of responsibility. Both can be true at once.
The aftermath is murkier still, and rests on OTHER and OUTLET sourcing rather than any primary statement. SecurityWeek, citing TechCrunch, reports Klue privately told customers it had been in contact with the threat actor, which began deleting stolen data, and notes Icarus's leak site went offline during that period, which SecurityWeek reads as a possible sign a ransom was paid. Klue reportedly also told customers that Icarus was itself hacked and that the stolen data is now held by a second threat actor running a separate extortion campaign, which allegedly took only a subset of the material. Klue confirmed the breach publicly and said it was investigating, but per SecurityWeek had not published findings. Defenders should plan on the assumption that deletion promises are worthless and that at least two parties have held this data.
The Attack Technique
This is a token-theft supply chain attack against a SaaS integration, and the mechanics are consistent across sources. Klue's own incident update, as cited by InvideLabs, says the attacker entered through a compromised legacy credential associated with an integration service. InvideLabs, citing a timeline published by Huntress, adds that the attacker then pushed malicious code into Klue's backend to collect OAuth tokens for connected services, and that Klue later removed the unauthorized code. Those tokens were used to query connected customer systems and copy data out.
The critical property, spelled out by UpGuard, is that stolen OAuth tokens grant access to CRM data without needing user credentials. Multi-factor authentication on the customer side does not help, because the attacker never authenticates as a user. From Salesforce's perspective the traffic is a legitimate, previously authorized integration. TMC Insight reports that Huntress and ReliaQuest observed Python scripts querying the Salesforce API at scale across the environments of multiple Klue customers, which is the detection signature worth carrying into your own telemetry: high-volume, scripted API enumeration from an integration identity, outside its normal access pattern.
LastPass's containment, per InfoSec Today, included discontinuing employee access to Klue, rotating exposed API tokens, notifying law enforcement, and working with Klue and Salesforce on scoping. The company said remediation was completed and exposed OAuth tokens revoked, and that its Threat Intelligence, Mitigation and Escalation team is sharing indicators with the broader community.
What Organizations Should Do
- Inventory every OAuth grant against your SaaS platforms. Pull the connected app and integration list for Salesforce, Gong, and equivalent systems, and map each token to a business owner and a justification. Anything unowned or unused gets revoked now, not at the next review cycle.
- Kill legacy credentials and legacy auth paths at integration providers. The initial access here was a compromised legacy credential tied to an integration service. Audit your own vendors for the same pattern and require modern, scoped, short-lived credentials in contract language.
- Scope tokens to the minimum object set and alert on volume. An integration that needs contact records should not be able to read support cases at scale. Build detections for scripted, high-rate API enumeration by integration identities, which is exactly what Huntress and ReliaQuest observed here per TMC Insight.
- Treat vendor-side deletion assurances as unreliable. With a second actor reportedly holding the data after Icarus was itself compromised, plan for indefinite exposure. Notify affected individuals on that basis rather than on the vendor's assurance.
- Pre-brief users and support staff on the follow-on social engineering. ZDNET, UpGuard and Protos all converge on this as the practical risk. Tell customers LastPass will not call, text, or email asking for master passwords, MFA codes, or vault access, and give support agents a hardened caller-verification script, since attackers now hold prior case context.
- Add third-party token compromise to your incident response playbook. The revocation, rotation, and downstream-notification sequence LastPass ran should be a rehearsed runbook, not an improvisation, including a pre-built list of which vendors hold tokens into which systems.
Sources: LastPass customer info leaked again after third-party data breach -... | Security News This Week: LastPass Users Had Their Data Stolen—Again... | More Klue Breach Victims Identified as Hackers Get Hacked - Securit... | LastPass hit by new data breach - 4 steps you should take now | LastPass data breach exposes customer names and contact information... | LastPass Confirms Vendor Breach Exposed Customer Contact, Support D... | LastPass confirms another customer data breach. Developers react: “... | Supply Chain Attack Exposes LastPass Customer Data via Klue TMC In...