Incident BriefingsLastPass Salesforce data incident through Klue

LastPass Salesforce data incident through Klue

The breach involved CRM contact and support data. LastPass said customer vaults and its product infrastructure were unaffected.

Last modified

Summary

  • Environment: Klue integration with LastPass Salesforce CRM
  • Operational impact: LastPass reported products and services unaffected
  • Financial impact: No incident cost established in the reviewed evidence
  • Record status: Developing record. Reviewed October 13, 2026; updated as evidence emerges.

What happened

LastPass said attackers used tokens obtained from Klue to access customer data in its Salesforce environment. Its June disclosure concerns a separate incident from the 2022 vault theft. [2]

Impact

Affected data included contact details, support cases and sales information. LastPass said its vaults, products and infrastructure were unaffected; it found no evidence of access to Gong data. [2]

Timeline

  1. LastPass informed

    LastPass learned of the supplier incident.

    [2]

  2. LastPass disclosure

    LastPass announced the CRM-data access and token rotation.

    [2]

  3. Supplier forensic summary

    Klue published its CrowdStrike investigation summary.

    [1]

  4. Briefing updated

    This briefing was last reviewed and updated on October 13, 2026.

Threat Group & Attack Vector

Klue’s summary says a compromised GitHub personal access token enabled malicious integration-service code on June 11, collecting OAuth credentials. How that original token was obtained remained unresolved. [1]

Actors

  • No threat actor group has been identified in the reviewed public evidence.

TTPs

Response

LastPass rotated tokens and ended employee access to Klue. [2] Klue said it disabled affected integration workloads and compromised tokens on June 12. [1]