LastPass Confirms Customer Data Exposure in Klue Supply Chain Breach
Summary
LastPass confirmed customer contact and support data was exposed after stolen Klue OAuth tokens were used to access its Salesforce records. LastPass says its vaults and infrastructure were unaffected and remediation is complete.
Key points
- LastPass confirmed exposure of customer contact details and support records; the number of affected customers was not disclosed.
- The article says attackers stole OAuth tokens from Klue and used them to access LastPass Salesforce records through a trusted integration.
- The exposed information included names, email addresses, phone numbers, physical addresses, support cases, and sales records.
- LastPass said customer vaults and internal infrastructure were not affected.
- The article attributes the breach of Klue’s backend to an extortion group tracked as Icarus; it also says ReliaQuest linked the theft to broader Salesforce data harvesting.
- LastPass cut employee access to Klue, rotated exposed tokens, opened an investigation with Klue and Salesforce, and notified law enforcement; remediation was reported as complete.
- Other named Klue customers reportedly affected include Recorded Future, Tanium, Jamf, and Sprout Social.
Article Details
- Victim Organization
- LastPass
- Incident Type
- Supply-chain breach involving stolen OAuth tokens used to access Salesforce records
- Data Types Exposed
- Customer names
- Email addresses
- Phone numbers
- Physical addresses
- Support case data
- Sales records
- Affected Records
- Not disclosed
- Affected Data Size
- Not disclosed
- Operational Impact
- LastPass customer contact, support, and sales data was accessed. LastPass said its customer vaults and internal infrastructure were not compromised. It cut employee access to Klue, rotated exposed tokens, and reported remediation completed.
- Ransom Or Extortion
- The article describes Icarus as an extortion group involved in the breach; no ransom demand or payment details are reported.
- Claim Status
- confirmed
Threat Actors
Vendors
KlueLastPass confirmed that customer contact and support data was exposed in a supply chain breach involving Klue, after attackers stole OAuth tokens and used them to access Salesforce records.SalesforceLastPass confirmed that customer contact and support data was exposed in a supply chain breach involving Klue, after attackers stole OAuth tokens and used them to access Salesforce records.
Products
KlueLastPass confirmed that customer contact and support data was exposed in a supply chain breach involving Klue, after attackers stole OAuth tokens and used them to access Salesforce records.LastPassLastPass confirmed that customer contact and support data was exposed in a supply chain breach involving Klue, after attackers stole OAuth tokens and used them to access Salesforce records.SalesforceLastPass confirmed that customer contact and support data was exposed in a supply chain breach involving Klue, after attackers stole OAuth tokens and used them to access Salesforce records.