Security News This Week: LastPass Users Had Their Data Stolen—Again
LastPass customers' personal data was exposed due to a breach at partner company Klue.
Password manager LastPass has reported another data exposure incident affecting its customers. The breach occurred not through LastPass's own systems, but via a compromise at its business intelligence partner, Klue. Attackers gained access to Klue customer access tokens, which were then used to extract data from integrated platforms like Salesforce, exposing customer names, phone numbers, email addresses, and physical addresses.
AI summary of the linked source. Not reviewed by an editor. How this works
Run Klue?
Get an email when a new story names Klue, usually within the hour.
Free. Your list stays private and never appears in a subject line. One click stops it. How Vendor Watch worksPrivacy
The lesson from this incident
Full lessonThe root cause of this incident was insufficient third-party risk management: LastPass customer data was exposed not through LastPass itself, but through a compromise at its business intelligence vendor, Klue. Attackers stole customer access tokens from Klue, which provided a pivot point into integrated platforms like Salesforce — demonstrating how a single weak link in a vendor ecosystem can cascade into a major data exposure. This matters because organizations often focus security efforts inward while underestimating the risk surface introduced by partners who hold sensitive tokens or data. The exposure of names, phone numbers, emails, and physical addresses creates real-world risks including phishing, social engineering, and identity theft for affected users.
What helps against this
How we list vendors- Identity governance and single sign-on
People who leave or change roles lose access everywhere at once, and forgotten accounts stop piling up.
- Data loss prevention (DLP)
Sensitive data cannot quietly leave by email, upload, USB stick or AI tool.
- Third-party risk management (TPRM)
You know which suppliers could hurt you, and you hear quickly when one of them is breached.