LastPass Breach: Customer Data Stolen via Klue Attack

LastPass has confirmed a significant data breach originating from a supply chain attack impacting Klue, a third-party market intelligence platform. The incident, which came to light on June 12th, 2026, involved attackers obtaining OAuth tokens held by Klue for its customers, including LastPass. These credentials were then used to access LastPass' Salesforce environment.

Sensitive customer data, such as names, contact information, and sales-related CRM data, was exfiltrated. While the company stated that master passwords were not compromised, the exposed details pose a substantial risk for targeted phishing campaigns. LastPass has advised its users to exercise extreme caution with incoming communications, particularly those purporting to be from the company.

The threat actor known as Icarus has claimed responsibility for the breach, reportedly exploiting legacy credentials to infiltrate Klue. This attack has also affected other prominent organizations, including Recorded Future, Tanium, Jamf, Sprout Social, Gong, and Insurity. LastPass has since revoked employee access to Klue.