[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fLFqPnWC35TlUwXCAIro3UwkdXQh6uX_SmjL2qZhHZ1s":3},{"lesson":4},{"id":5,"slug":6,"article_id":7,"title":8,"body":9,"prevention":10,"framework_refs":11,"framework_notes":23,"status":24,"created_at":25,"published_at":26,"article":27,"tags":31,"podcasts":50,"controls":57},"5b7e9ae3-0b3d-42df-b609-e8c616ed3429","lastpass-customer-data-exposed-via-third-party-partner-breach","3551f63c-df7e-40c8-9b3c-d2e9869f9822","LastPass Customer Data Exposed via Third-Party Partner Breach","The root cause of this incident was insufficient third-party risk management: LastPass customer data was exposed not through LastPass itself, but through a compromise at its business intelligence vendor, Klue. Attackers stole customer access tokens from Klue, which provided a pivot point into integrated platforms like Salesforce — demonstrating how a single weak link in a vendor ecosystem can cascade into a major data exposure. This matters because organizations often focus security efforts inward while underestimating the risk surface introduced by partners who hold sensitive tokens or data. The exposure of names, phone numbers, emails, and physical addresses creates real-world risks including phishing, social engineering, and identity theft for affected users.","**Immediate actions:**\n- Revoke and rotate all third-party access tokens and API credentials shared with Klue or similar business intelligence vendors.\n- Audit all vendor integrations (e.g., Salesforce, CRMs) to identify which external parties hold active access tokens and what data they can reach.\n\n**Long-term improvements:**\n- Implement a formal Third-Party Risk Management (TPRM) program that includes regular security assessments and contractual security requirements for all vendors.\n- Enforce least-privilege access for all vendor integrations, ensuring partners can only access the minimum data necessary for their function.\n- Adopt just-in-time (JIT) token provisioning and automatic token expiration to reduce the window of exposure if credentials are compromised.\n\n**Detection measures:**\n- Deploy continuous monitoring and alerting on Salesforce and other integrated platforms for anomalous data access or bulk data exports originating from third-party tokens.\n- Require vendors to report security incidents involving your data within a defined SLA (e.g., 24–72 hours) and verify compliance through contractual obligations.",[12,13,14,15,16,17,18,19,20,21,22],"CIS Control 15 – Service Provider Management","CIS Control 6 – Access Control Management","NIST SP 800-161 – Supply Chain Risk Management","NIST AC-2 – Account Management","NIST AC-17 – Remote Access","NIST IR-6 – Incident Reporting","ISO\u002FIEC 27036 – Information Security for Supplier Relationships","GDPR Article 28 – Processor Obligations","GDPR Article 33 – Notification of a Personal Data Breach","NIST CSF DE.CM-3 – Personnel Activity Monitoring","SOC 2 CC9.2 – Vendor and Business Partner Risk Management",{},"published","2026-06-27T12:20:21.573318+00:00","2026-06-27T12:20:21.432+00:00",{"id":7,"url":28,"slug":29,"title":30},"https:\u002F\u002Fwww.wired.com\u002Fstory\u002Fsecurity-news-this-week-lastpass-users-had-their-data-stolen-again\u002F","security-news-this-week-lastpass-users-had-their-data-stolen-again-9fc4d2","Security News This Week: LastPass Users Had Their Data Stolen—Again",[32,38,44],{"id":33,"name":34,"slug":35,"description":36,"color":37},"1ec88fde-2d0f-4ed8-932a-33f5ccc0fdc7","Access Control","access-control","Excessive privileges, missing MFA, weak auth","#f97316",{"id":39,"name":40,"slug":41,"description":42,"color":43},"c8b843a5-d5a7-41d1-8d3b-cabded09d2ef","Data Protection","data-protection","Unencrypted data, missing DLP, poor classification","#3b82f6",{"id":45,"name":46,"slug":47,"description":48,"color":49},"f0c2a0af-58aa-4128-87c9-6acd30f2dc48","Supply Chain","supply-chain","Third-party risk, compromised dependencies","#8b5cf6",[51],{"id":52,"date":53,"edition":54,"title":55,"audio_url":56},"14077edc-fd00-482f-bd76-28d0d4234e86","2026-06-27","afternoon","ThreatNoir Weekend Brief — June 27","https:\u002F\u002Fcdn.threatnoir.com\u002Fpodcasts\u002F2026-06-27\u002Fthreatnoir-afternoon-brief-2026-06-27.mp3",[58,62,66],{"slug":59,"name":60,"problem":61},"identity-governance","Identity governance and single sign-on","People who leave or change roles lose access everywhere at once, and forgotten accounts stop piling up.",{"slug":63,"name":64,"problem":65},"data-loss-prevention","Data loss prevention (DLP)","Sensitive data cannot quietly leave by email, upload, USB stick or AI tool.",{"slug":67,"name":68,"problem":69},"third-party-risk-management","Third-party risk management (TPRM)","You know which suppliers could hurt you, and you hear quickly when one of them is breached."]