InfoSecBulletin Cybersecurity for mankind
LastPass has reported a security issue with its vendor, Klue. This incident allowed an attacker unauthorized access to customer data. The company confirmed that the breach did not affect its core infrastructure or password vaults. However, it highlights ongoing risks associated with SaaS integrations and OAuth token exposure.
The event was found on June 12, when LastPass was told about strange activity involving Klue, a platform for market information used by its go-to market teams.
Meta’s louisiana data center to exceed 250 billion price tag
Ransomware Crisis in 2026: 5,064 Organizations Affected in 135 Countries
Palo Alto Networks Addresses 13 Vulnerabilities
Critical Dell BIOS & Zimbra Flaws Expose Enterprise Systems
CoLoCity Launches New 1.0 MW Data Center Facility at Gulshan
Daily Cyber security update for 10. 07. 2026
How Hacker Compromise AWS Cloud Environment Using AI in 72 Hours
Mycelium Framework: First AI-as-a-Service Botnet
CrowdStrike Shows 5 New Prompt Injection Techniques for AI Agents
Critical GCP Dialogflow Vulnerability Allows Malicious Code Injection
LastPass Customer Data Exposed
A hacker got OAuth tokens stored by Klue for the customers, including LastPass. Attackers used the stolen OAuth tokens to access CRM data in LastPass’ Salesforce instance, bypassing traditional login controls by exploiting the trusted API-based authentication mechanism between services.
In this situation, the attacker used real tokens to get data without needing user passwords. This shows how token-based trust is being misused more in supply-chain attacks.
LastPass explained that the attack only affected systems linked to Klue. Its main products, internal systems, and customer password storage were safe.
Additionally, there is no evidence that data from Gong systems was accessed during the intrusion. The compromised data includes standard business contact and CRM-related information.
This includes customer names, emails, phone numbers, addresses, support case information, and sales records.
LastPass started an urgent response to the incident. The company removed all employee access to Klue, changed the exposed API and OAuth tokens, and began a joint investigation with Klue and Salesforce.
Law enforcement agencies have been informed. LastPass said its TIME team is working with the security community to share information about threats and stop the campaign.
LastPass warned customers to be careful of messages they didn’t ask for, as wrongdoers might try to use leaked contact info. The company said it will never ask for master passwords and told users to check all messages through official support.
As part of the investigation, several indicators of compromise have been identified. Suspicious IP addresses linked to the activity include 138.226.246[.]94, 94.154.32[.]160, 159.183.215[.]61, and 159.183.181[.]239.
