LastPass confirms customer data accessed in Klue supply chain incident

LastPass disclosed that unauthorized parties reached customer information held in its Salesforce setup after obtaining the firm's OAuth tokens during the Klue supply chain attack earlier this month.

LastPass discloses the breach details. The password management company reported becoming aware of the Klue event on June 12 and promptly started an investigation. According to the firm, "an unauthorized actor was able to obtain OAuth tokens Klue held for many of its customers, including LastPass." Those credentials reportedly allowed access to LastPass customer data inside the Salesforce environment. The company stressed that its products, services, infrastructure, and customer vaults stayed untouched, with the probe finding no sign of access to Gong-linked records such as calls or emails.

Exposed data types identified. Information that may have been viewed includes customer names, phone numbers, email addresses, physical addresses, support case details, and sales or CRM-related records. LastPass noted that attackers could exploit these details for phishing or social engineering. The firm urged caution with unexpected calls or messages that seek private information and warned against sharing master passwords with anyone.

Klue attack linked to Icarus group. The supply chain compromise was claimed by the Icarus extortion group, which breached the AI-powered market intelligence platform and took OAuth tokens used to link customer Salesforce environments. Multiple entities were hit, among them Recorded Future, Tanium, Jamf, Sprout Social, Gong, and Insurity. The intruders extracted CRM data and began an extortion effort.

Response measures and warnings issued. LastPass has cut employee access to Klue, rotated the exposed API and OAuth tokens, and contacted law enforcement as the inquiry proceeds. The company cautioned that the operators are sending messages from domains such as baccarat.com[.]au, robinskitchen.com[.]au, and house[.]com.au, adding that only official support channels can be trusted.

Broader implications for supply chain risks. Security teams continue to examine third-party integration weaknesses that tie into enterprise CRM platforms. The incident also affected other organizations beyond LastPass.