What We Know
LastPass has notified users that it was impacted by a supply‑chain attack tied to Klue, a third‑party vendor. Attackers gained access to Klue-related resources and used that access to steal support cases from LastPass’ Salesforce environment, according to reporting from multiple outlets. LastPass confirmed the incident and notified affected customers.
Security reporting identifies the exposed data as support‑case records that included customer names and contact information. UpGuard’s timeline in the reporting indicates the incident was discovered on June 12 and reported on June 22. Other cybersecurity vendors that used Klue’s services—such as BeyondTrust—were similarly flagged in coverage as affected by the Klue‑Salesforce compromise. The disclosure has drawn scrutiny and skepticism from users about LastPass’ ability to protect customer data.
Source Comparison
Aligned reportingCorroborates
- BleepingComputer↗Confirms LastPass said hackers accessed support cases in its Salesforce after exploiting Klue-related resources and that it notified affected customers.
- 9to5mac.com↗Reports LastPass notified users that support-case data tied to the Klue supply-chain incident was accessed from its Salesforce environment.
- techcrunch.com↗States LastPass said customer support case data was stolen during the Klue breach, matching the briefing's account.
- techradar.com↗Details LastPass confirmed a supply-chain compromise via Klue that resulted in access to customer support-case records.
- helpnetsecurity.com↗Reports LastPass customer data was exposed through the Klue supply-chain attack and aligns with LastPass's confirmation of accessed support cases.
- securityweek.com↗Reports that BeyondTrust and LastPass were both impacted by the Klue-Salesforce incident, corroborating that other vendors were flagged as affected.