LastPass Confirms Customer Data Access in Klue Supply-Chain Attack
Summary
LastPass confirmed attackers used OAuth tokens stolen from Klue to access customer data in its Salesforce environment. The company says its products and vaults were unaffected and has rotated tokens and notified law enforcement.
Key points
- LastPass said an unauthorized actor used OAuth tokens obtained from Klue to access customer data in LastPass’s Salesforce environment.
- Potentially exposed information includes names, phone numbers, email and physical addresses, support cases, and sales or CRM data.
- LastPass said its products, services, infrastructure, and customer vaults were not affected.
- The investigation found no evidence that the attacker accessed Gong-related data.
- LastPass disabled employee access to Klue, rotated exposed API and OAuth tokens, and notified law enforcement.
- The Icarus extortion group claimed the Klue attack; the article attributes the wider campaign’s claims about CRM data theft and extortion to the threat actor.
Article Details
- Victim Organization
- LastPass
- Incident Type
- Supply-chain attack involving stolen OAuth tokens and unauthorized access to customer data in LastPass's Salesforce environment
- Data Types Exposed
- Customer names
- Phone numbers
- Email addresses
- Physical addresses
- Support case information
- Sales/CRM-related data
- Operational Impact
- Customer data in LastPass's Salesforce environment was accessed. LastPass said its products, services, infrastructure, and customer vaults were not affected. It disabled employee access to Klue, rotated exposed API/OAuth tokens, and notified law enforcement.
- Ransom Or Extortion
- The article says the Icarus extortion group claimed the Klue supply-chain attack and that the threat actor launched an extortion campaign. The source does not specify a ransom demand.
- Claim Status
- confirmed
Indicators of compromise
| Type | Indicator | Context |
|---|---|---|
| DOMAIN | baccarat[.]com[.]au | Sender domain the article says threat actors used; LastPass warned users to trust only official support channels. |
| DOMAIN | house[.]com[.]au | Sender domain the article says threat actors used; LastPass warned users to trust only official support channels. |
| DOMAIN | robinskitchen[.]com[.]au | Sender domain the article says threat actors used; LastPass warned users to trust only official support channels. |
Threat Actors
Vendors
Gong#LastPassKlueLastPass disclosed that hackers accessed customer data in its Salesforce environment after stealing OAuth tokens in a Klue supply chain attack.SalesforceLastPass disclosed that hackers accessed customer data in its Salesforce environment after stealing OAuth tokens in a Klue supply chain attack.
Products
Gong#LastPassKlueLastPass disclosed that hackers accessed customer data in its Salesforce environment after stealing OAuth tokens in a Klue supply chain attack.LastPassLastPass disclosed that hackers accessed customer data in its Salesforce environment after stealing OAuth tokens in a Klue supply chain attack.SalesforceLastPass disclosed that hackers accessed customer data in its Salesforce environment after stealing OAuth tokens in a Klue supply chain attack.