LastPass experienced a security incident through Klue, a third-party market intelligence platform integrated with its Salesforce and Gong systems. On June 12, 2026, LastPass was notified that an unauthorized actor exploited stolen OAuth tokens held by Klue to access customer relationship management data within LastPass's Salesforce environment. The exposed information includes customer names, email addresses, phone numbers, physical addresses, support case data, and sales records. Multiple Klue customers were affected by this supply chain attack. LastPass confirmed no Gong data was accessed, and customer vaults, master passwords, and encrypted vault data remain unaffected. The company has terminated Klue access, rotated compromised API tokens, and is cooperating with law enforcement while warning customers about potential phishing attempts using the exposed contact information.
Recent cybersecurity news has shifted focus from AI and ransomware to breaches, particularly those involving compromised OAuth tokens linked to Salesloft's Drift integration. The main themes emerging are supply chain and identity attacks, with a need to redefine these concepts in the context of SaaS environments. Supply chain attacks now extend beyond hardware and software to include the datapath, while identity attacks increasingly target interconnected applications. The article emphasizes the importance of broadening cybersecurity focus and introduces the Cyber Threat Intelligence Capability Maturity Model (CTI-CMM) as a framework for organizations to assess and enhance their cyber threat intelligence programs.
