[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fyGouKX_M2VyUM2Hv7JCAcBT0lpDIP9nA5ST4URg2TVQ":3},{"article":4,"iocs":43,"watch_terms":44,"solutions":45,"lesson":132},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":25,"category":26,"article_tags":30},"3551f63c-df7e-40c8-9b3c-d2e9869f9822","Security News This Week: LastPass Users Had Their Data Stolen—Again","security-news-this-week-lastpass-users-had-their-data-stolen-again-9fc4d2","Plus: Former national security advisor John Bolton pleads guilty in classified-materials case, Microsoft helps take down major infostealer infrastructure, and more.","Password manager LastPass has reported another data exposure incident affecting its customers. The breach occurred not through LastPass's own systems, but via a compromise at its business intelligence partner, Klue. Attackers gained access to Klue customer access tokens, which were then used to extract data from integrated platforms like Salesforce, exposing customer names, phone numbers, email addresses, and physical addresses.","LastPass customers' personal data was exposed due to a breach at partner company Klue.","https:\u002F\u002Fwww.wired.com\u002Fstory\u002Fsecurity-news-this-week-lastpass-users-had-their-data-stolen-again\u002F","https:\u002F\u002Fmedia.wired.com\u002Fphotos\u002F6a3f04f5576bf7ee5cfb20ec\u002Fmaster\u002Fpass\u002FLastPass-Data-Leak-Security-1246524546.jpg","2026-06-27T10:30:00+00:00","2026-06-27T12:00:14.857555+00:00",7,[17,20,23],{"name":18,"type":19},"LastPass","product",{"name":21,"type":22},"Klue","vendor",{"name":24,"type":19},"Salesforce","2e06f76c-d5b9-4f54-9eef-4d3447b10730",{"id":25,"icon":27,"name":28,"slug":29},null,"Breaches","breaches",[31,33,38],{"category":32},{"id":25,"icon":27,"name":28,"slug":29},{"category":34},{"id":35,"icon":27,"name":36,"slug":37},"614132b8-5837-4952-b8b5-c6c9a32a1d85","Privacy","privacy",{"category":39},{"id":40,"icon":27,"name":41,"slug":42},"e7b231c8-5f79-4465-8d38-1ef13aea5a14","Threat Intelligence","threat-intelligence",[],[21,18,24],{"controls":46,"vendors":131},[47,76,102],{"slug":48,"name":49,"problem":50,"products":51},"identity-governance","Identity governance and single sign-on","People who leave or change roles lose access everywhere at once, and forgotten accounts stop piling up.",[52,60,68],{"vendor_slug":53,"vendor_name":54,"vendor_logo":55,"product_slug":56,"product_name":57,"url":58,"description":59},"microsoft","Microsoft","\u002Fvendor-logos\u002Fmicrosoft.png","entra-id","Microsoft Entra ID","https:\u002F\u002Fwww.microsoft.com\u002Fen-us\u002Fsecurity\u002Fbusiness\u002Fidentity-access\u002Fmicrosoft-entra-id","Cloud identity and access management with single sign-on, conditional access, passkeys and identity governance.",{"vendor_slug":61,"vendor_name":62,"vendor_logo":63,"product_slug":64,"product_name":65,"url":66,"description":67},"okta","Okta","\u002Fvendor-logos\u002Fokta.png","workforce-identity","Okta Workforce Identity","https:\u002F\u002Fwww.okta.com\u002Fproducts\u002Fworkforce-identity\u002F","Single sign-on, adaptive MFA including phishing-resistant methods, and lifecycle management for employees.",{"vendor_slug":69,"vendor_name":70,"vendor_logo":71,"product_slug":72,"product_name":73,"url":74,"description":75},"sailpoint","SailPoint","\u002Fvendor-logos\u002Fsailpoint.png","human-fabric","SailPoint Human Fabric","https:\u002F\u002Fwww.sailpoint.com\u002Fproducts\u002Fhuman-fabric","Identity governance platform, the successor to Identity Security Cloud: lifecycle management, access requests and continuous access reviews.",{"slug":77,"name":78,"problem":79,"products":80},"data-loss-prevention","Data loss prevention (DLP)","Sensitive data cannot quietly leave by email, upload, USB stick or AI tool.",[81,89,97],{"vendor_slug":82,"vendor_name":83,"vendor_logo":84,"product_slug":85,"product_name":86,"url":87,"description":88},"forcepoint","Forcepoint","\u002Fvendor-logos\u002Fforcepoint.png","forcepoint-dlp","Forcepoint DLP","https:\u002F\u002Fwww.forcepoint.com\u002Fproduct\u002Fdlp-data-loss-prevention","Data loss prevention for endpoints, network, email and cloud applications.",{"vendor_slug":90,"vendor_name":91,"vendor_logo":92,"product_slug":93,"product_name":94,"url":95,"description":96},"proofpoint","Proofpoint","\u002Fvendor-logos\u002Fproofpoint.png","enterprise-dlp","Proofpoint Enterprise DLP","https:\u002F\u002Fwww.proofpoint.com\u002Fus\u002Fproducts\u002Fdata-loss-prevention","Data loss prevention across email, cloud and endpoints.",{"vendor_slug":53,"vendor_name":54,"vendor_logo":55,"product_slug":98,"product_name":99,"url":100,"description":101},"purview-dlp","Microsoft Purview Data Loss Prevention","https:\u002F\u002Fwww.microsoft.com\u002Fen-us\u002Fsecurity\u002Fbusiness\u002Fdata-security-governance\u002Fmicrosoft-purview-data-security","Data classification and loss prevention across Microsoft 365, endpoints and connected cloud apps.",{"slug":103,"name":104,"problem":105,"products":106},"third-party-risk-management","Third-party risk management (TPRM)","You know which suppliers could hurt you, and you hear quickly when one of them is breached.",[107,115,123],{"vendor_slug":108,"vendor_name":109,"vendor_logo":110,"product_slug":111,"product_name":112,"url":113,"description":114},"onetrust","OneTrust","\u002Fvendor-logos\u002Fonetrust.png","third-party-management","OneTrust Third-Party Management","https:\u002F\u002Fwww.onetrust.com\u002Fsolutions\u002Fthird-party-management\u002F","Supplier inventory, risk assessments and monitoring across privacy and security.",{"vendor_slug":116,"vendor_name":117,"vendor_logo":118,"product_slug":119,"product_name":120,"url":121,"description":122},"securityscorecard","SecurityScorecard","\u002Fvendor-logos\u002Fsecurityscorecard.png","security-ratings","SecurityScorecard Ratings","https:\u002F\u002Fsecurityscorecard.com\u002Fsolutions\u002Fuse-cases\u002Fsecurity-ratings\u002F","Outside-in security ratings and monitoring of suppliers.",{"vendor_slug":124,"vendor_name":125,"vendor_logo":126,"product_slug":127,"product_name":128,"url":129,"description":130},"bitsight","Bitsight","\u002Fvendor-logos\u002Fbitsight.png","bitsight-tprm","Bitsight Third-Party Risk Management","https:\u002F\u002Fwww.bitsight.com\u002Fproducts\u002Fthird-party-risk-management","Supplier assessments and continuous monitoring based on security ratings.",[],{"slug":133,"title":134,"body":135,"framework_refs":136,"framework_notes":148},"lastpass-customer-data-exposed-via-third-party-partner-breach","LastPass Customer Data Exposed via Third-Party Partner Breach","The root cause of this incident was insufficient third-party risk management: LastPass customer data was exposed not through LastPass itself, but through a compromise at its business intelligence vendor, Klue. Attackers stole customer access tokens from Klue, which provided a pivot point into integrated platforms like Salesforce — demonstrating how a single weak link in a vendor ecosystem can cascade into a major data exposure. This matters because organizations often focus security efforts inward while underestimating the risk surface introduced by partners who hold sensitive tokens or data. The exposure of names, phone numbers, emails, and physical addresses creates real-world risks including phishing, social engineering, and identity theft for affected users.",[137,138,139,140,141,142,143,144,145,146,147],"CIS Control 15 – Service Provider Management","CIS Control 6 – Access Control Management","NIST SP 800-161 – Supply Chain Risk Management","NIST AC-2 – Account Management","NIST AC-17 – Remote Access","NIST IR-6 – Incident Reporting","ISO\u002FIEC 27036 – Information Security for Supplier Relationships","GDPR Article 28 – Processor Obligations","GDPR Article 33 – Notification of a Personal Data Breach","NIST CSF DE.CM-3 – Personnel Activity Monitoring","SOC 2 CC9.2 – Vendor and Business Partner Risk Management",{}]