LastPass, a Boston-based password manager subsidiary of LogMeIn, is notifying customers of a data breach stemming from a cyberattack at third-party market intelligence provider Klue. The hack, disclosed to LastPass on June 12, allowed an unauthorized actor to obtain OAuth tokens that Klue held for multiple clients, including LastPass.

Using those credentials, the attackers accessed customer information stored within LastPass's Salesforce environment. Klue's platform integrates with both Salesforce and Gong systems. LastPass confirmed the hackers were able to steal some customer data, though the company stated that the exposed Klue OAuth tokens have since been rotated.

LastPass joins a list of prominent cybersecurity firms affected by the Klue breach, including Gong, Jamf, HackerOne, Insurity, OneTrust, Recorded Future, Snyk, Sprout Social, and Tanium, per TechCrunch. The incident underscores the supply-chain risk when companies grant third-party vendors access to sensitive systems through interconnected platforms.

Organizations relying on password managers face growing exposure from vendor ecosystems. Salesforce databases, in particular, have become frequent targets because they often house large volumes of customer information. Companies deploying similar integrations should review their OAuth token security and audit third-party access privileges.

LastPass has a history of security incidents; a 2022 breach exposed encrypted vault data. Customers are advised to enable multi-factor authentication and monitor for credential misuse.

Counter argument: Third-party breaches are notoriously difficult to prevent entirely, and the tokens have been revoked. Still, the incident raises questions about LastPass's vendor due diligence, given its past security struggles.

ai_context: This brief is based solely on a Fast Company report and TechCrunch attribution within it. Details on stolen data scope and customer impact remain limited to what was publicly disclosed. No independent verification was performed.

topics: data breach, password manager, supply-chain security, third-party risk

entities: LastPass, LogMeIn, Klue, Salesforce, Gong, Jamf, HackerOne, Insurity, OneTrust, Recorded Future, Snyk, Sprout Social, Tanium, TechCrunch, Boston

impact_score: 5.5

confidence: 0.7

readtimesecs: 90