LastPass Data Breach

LastPass, a widely used password management platform, disclosed a data security incident involving unauthorized access to customer data stored in its Salesforce environment. The breach stemmed from a third-party supply chain attack affecting Klue, a market intelligence platform used by LastPass’s go-to-market teams.

According to the company, attackers used stolen OAuth tokens obtained through the Klue incident to access LastPass customer data. While LastPass confirmed that its core products, services, and encrypted vault systems were not impacted, certain customer information may have been exposed through its CRM systems.

The incident highlights growing risks tied to third-party integrations and supply chain vulnerabilities, particularly where OAuth tokens and API connections are involved.

LastPass Data Breach Investigation

LastPass stated it became aware of the incident on June 12, 2026, after learning of a compromise at Klue. An investigation revealed that attackers gained access to OAuth tokens that allowed them to connect to LastPass’s Salesforce environment.

Using these tokens, the threat actor was able to access customer-related CRM data. LastPass emphasized that no evidence indicates compromise of its password vaults or core infrastructure. Additionally, there was no indication that Gong-related data (such as customer calls or emails) was accessed.

The attack has been attributed to a broader supply chain compromise claimed by the “Icarus” extortion group, which reportedly used compromised credentials to access multiple organizations through interconnected SaaS platforms.

In response, LastPass disabled integrations with Klue, rotated affected tokens, and notified law enforcement. The company also reviewed internal access logs and implemented additional safeguards to reduce future risk from third-party integrations.

When Did This Breach Occur?

• Incident Awareness Date: June 12, 2026
• Attack Vector: Third-party supply chain (Klue integration)
• Systems Affected: Salesforce CRM environment
• Status: Investigation ongoing

What Information Was Breached?

According to LastPass, the following categories of customer data may have been exposed:

• Customer names
• Phone numbers
• Email addresses
• Physical addresses
• Support case information
• Sales and CRM-related data

Importantly, LastPass confirmed that:

• Password vaults were not accessed
• Master passwords were not exposed
• Core product infrastructure was not impacted

What You Can Do

If you may have been affected by this incident, consider the following protective steps:

1. Watch for Phishing Attempts
   Be cautious of unsolicited emails or calls requesting sensitive information.
2. Do Not Share Credentials
   Never provide your master password or login details in response to support messages.
3. Monitor Account Activity
   Watch for suspicious logins or unauthorized support interactions.
4. Verify Communications
   Only trust official LastPass support channels and ignore messages from unknown domains.
5. Strengthen Security Practices
   Enable multi-factor authentication and review account security settings.

File a Data Breach Lawsuit Against LastPass

Individuals affected by CRM data exposure may have legal rights, even when core systems remain secure. Exposure of contact details and support records can increase the risk of targeted phishing, impersonation, and social engineering attacks.

Affected individuals may be eligible to participate in a class action lawsuit seeking compensation for privacy violations, time spent mitigating fraud risks, and potential security harms.

Contact us at Class Action U, where we’ll connect you with a lawyer skilled in class action lawsuits. If you believe your information may have been impacted, fill out a secure form to learn more. There is no cost to contact legal counsel and no obligation.