LastPass

Summary

LastPass disclosed that hackers accessed customer support case data and personal information through a breach at its technology partner Klue, which the company said did not affect its own infrastructure or password vaults. The stolen data included names, phone numbers, email addresses, physical addresses, and sales‑related information, while the exact contents of support tickets remain unknown. The company noted that other firms such as HackerOne, Recorded Future, and Tanium also reported data thefts linked to the same Klue incident, and the extortion group Icarus claimed responsibility for the breach.

Motives

Detailed motive labels are available to members.

TTPs

Detailed technique labels are available to members.

Description

On June 12, 2026, Klue’s chief executive reported that the company identified unauthorized access to its systems. The hacking and extortion group Icarus claimed responsibility for the breach and warned that it would release stolen data unless a ransom was paid. Following the discovery, Salesforce disabled the integration with Klue’s Battlecards application on June 17 after detecting the compromise. Huntress was the first cybersecurity firm to publicly state that its Salesforce data had been accessed in the attack. LastPass disclosed on June 23, 2026, via a blog post that it had been affected by the same Klue breach, noting that threat actors had obtained data from its Salesforce instance. The company emphasized that its own products, services, and infrastructure remained unaffected and that customer password vaults continued to be secure.

According to LastPass’s blog post, the attackers acquired customers’ names, phone numbers, email addresses, and physical addresses, as well as customer support case data and sales‑related information. The exact contents of the support tickets were not disclosed, though the company said it did not know what specific information they contained. In addition to LastPass, other firms such as HackerOne, Recorded Future, Tanium, and Gong reported similar data exposures stemming from the Klue incident. Gong stated that attackers may have accessed internal licensed user data, including usernames, business titles, and email addresses for a subset of its customers that used the Klue integration, and that Klue provided four suspicious IP addresses which Gong blocked. Huntress confirmed that the data posted by Icarus on its dark‑web leak site matched the scope of its own investigation and that no passwords, payment card information, telemetry, or product data had been accessed. At the time of the reports, six Klue customers were listed on Icarus’s leak site with partially redacted organization names.

LastPass began notifying affected customers about the theft of their personal information and support case records, although the company did not immediately respond to requests for comment regarding the number of individuals impacted. Klue’s CEO Jason Smith reiterated in a blog post that the breach was identified on June 12 and that Icarus had claimed responsibility, while noting that he had not replied to inquiries about the scale of the incident or any communication with the attackers. The incident added to LastPass’s history of security events, including a 2022 breach in which attackers copied the encrypted password vaults and later attempted offline cracking of weak master passwords. Despite the 2022 episode, LastPass maintained that the 2026 Klue‑related breach did not compromise its vaults. The disclosure concluded with the statement that customer vaults remained secure and that no product or service disruption had occurred as a result of the Klue attack.

Sources

Sources available to members: 2 sources.