On June 12, 2026, LastPass was notified that an unauthorized actor used stolen OAuth tokens from Klue, a third-party vendor integrated with LastPass's Salesforce and Gong systems, to access customer CRM data in LastPass's Salesforce environment. The compromised data includes personally identifiable information and sales-related records. The incident is a supply chain attack affecting multiple Klue customers. LastPass confirmed that no Gong data or encrypted vault data was accessed. The company responded by terminating Klue's access and rotating API tokens to prevent further unauthorized access. They are also cooperating with law enforcement and alerting customers to potential phishing attempts leveraging the exposed contact information.

The incident resulted in unauthorized access to sensitive customer relationship management data, including personal and sales information. This exposure increases the risk of targeted phishing attacks against affected customers. However, critical security assets such as customer vaults, master passwords, and encrypted vault data were not compromised. The breach affects multiple Klue customers, indicating a broader supply chain impact beyond LastPass alone.

LastPass has terminated Klue's access and rotated the compromised API tokens to prevent further unauthorized access. Customers have been warned about potential phishing attempts using the exposed contact information. Organizations using Klue or similar third-party integrations should review their OAuth token management and consider revoking and rotating tokens where appropriate. Monitoring for phishing attempts targeting exposed contacts is advised. Patch status is not applicable as this is a supply chain incident involving third-party token compromise rather than a software vulnerability.