LastPass confirms 2026 customer data breach: Klue hack exposed Salesforce data

LastPass said in a June 2026 notice that it was affected by a security breach tied to Klue. According to the company, the incident exposed OAuth tokens, gave attackers access to LastPass data stored in Salesforce, and may also have exposed customer contact records and support data. LastPass also says password vaults and master passwords were not affected.

Bitwarden Download

In LastPass’s account of what happened, the attackers breached Klue first, then used stolen customer tokens to get into Salesforce, along with systems connected to Salesforce and Gong. The company says it has since revoked that access, blocked employees from using Klue, and started an investigation.

LastPass says your password vault and master password weren’t affected. Still, customer contact records may have been exposed. So if you get an unexpected message that appears to be from LastPass, be extra careful, especially if it asks for credentials, payment, or urgent action on your account.

If you use LastPass regularly, take this seriously. Attackers don’t need access to your vault to do damage; stolen CRM data can be enough to fuel convincing phishing emails and fake support scams. And this comes after LastPass’s much more serious 2022 breach, later reports in 2023 and 2024 about offline cracking, reports of crypto theft tied to seed phrases, a £1.23 million fine from the UK Information Commissioner’s Office in 2025, a $24.5 million class-action settlement, and reports linking this Klue attack to Icarus and other affected companies, including Recorded Future, Tanium, Jamf, Sprout Social, Gong, and Insurity.

You can read LastPass’s June 2026 notice on LastPass’s official site.