LastPass reports breach after OAuth token theft from Klue

Password management company LastPass has confirmed that hackers accessed customer data stored in its Salesforce environment using OAuth tokens stolen from a third-party vendor, Klue. The company said it was notified of the incident by Klue on June 12, 2026. The breach exposed customer relationship management information, including names, phone numbers, email addresses, physical addresses, support case data, and sales-related records. LastPass emphasized that its own products, services, infrastructure, and customers' encrypted password vaults were not affected.

The unauthorized access stemmed from a supply chain attack on Klue, a market intelligence platform used by LastPass's sales and marketing teams. An extortion group known as Icarus compromised Klue's backend systems, pushed a malicious code update, and harvested OAuth tokens that Klue held for its customers. These tokens, which allow connected applications to share data without repeated logins, were then used to query Salesforce environments and copy CRM data from multiple organizations.

LastPass stated it has completed remediation efforts, including rotating the exposed OAuth tokens and discontinuing employee access to...