--- title: "LastPass Salesforce data incident through Klue" description: "LastPass customer data in Salesforce was accessed with OAuth tokens stolen through Klue’s June 2026 incident." incident_type: "Cybersecurity incident" status: "active" last_modified: "2026-10-13" canonical_url: "https://www.ally.security/incidents/lastpass-klue-salesforce-data-incident-2026" markdown_url: "https://www.ally.security/incidents/lastpass-klue-salesforce-data-incident-2026.md" stix_url: "https://www.ally.security/incidents/lastpass-klue-salesforce-data-incident-2026/stix.json" --- # LastPass Salesforce data incident through Klue The breach involved CRM contact and support data. LastPass said customer vaults and its product infrastructure were unaffected. Last modified Oct 13, 2026 · 2 sources ## Summary - **Environment:** Klue integration with LastPass Salesforce CRM - **Operational impact:** LastPass reported products and services unaffected - **Financial impact:** No incident cost established in the reviewed evidence ## What happened [LastPass](https://www.lastpass.com/) said attackers used tokens obtained from [Klue](https://klue.com/) to access customer data in its [Salesforce](https://www.salesforce.com/) environment. Its [June disclosure](https://blog.lastpass.com/posts/klue-supply-chain-incident-and-lastpass-response) concerns a separate incident from the [2022 vault theft](/incidents/lastpass-security-incident-2022). [2](#source-2) ## Impact Affected data included contact details, support cases and sales information. LastPass said its vaults, products and infrastructure were unaffected; it found no evidence of access to [Gong](https://www.gong.io/) data. [2](#source-2) ## Timeline ### June 12, 2026 — LastPass informed LastPass learned of the supplier incident. [2](#source-2) ### June 22, 2026 — LastPass disclosure LastPass announced the CRM-data access and token rotation. [2](#source-2) ### July 1, 2026 — Supplier forensic summary Klue published its [CrowdStrike investigation summary](https://klue.com/blog/crowdstrike-investigation-summary-and-security-improvements). [1](#source-1) ### October 13, 2026 — Briefing updated This briefing was last reviewed and updated on October 13, 2026. ## Threat Group & Attack Vector Klue’s summary says a compromised [GitHub](https://github.com/) personal access token enabled malicious integration-service code on June 11, collecting OAuth credentials. How that original token was obtained remained unresolved. [1](#source-1) ### Actors - No threat actor group has been identified in the reviewed public evidence. ### TTPs - T1550.001 — [Application Access Token](https://attack.mitre.org/techniques/T1550/001/): stolen OAuth tokens provided access to the CRM environment. [2](#source-2) ## Response LastPass rotated tokens and ended employee access to Klue. [2](#source-2) Klue said it disabled affected integration workloads and compromised tokens on June 12. [1](#source-1) ## Assets [Download the case-scoped STIX 2.1 bundle]() ## Sources Primary source records used to research this incident. ### CrowdStrike Investigation Summary and Security Improvements official · Klue · Jul 1, 2026 ### Klue Supply Chain Incident & LastPass Response official · LastPass · Jun 22, 2026
Evidence ledger Review the supporting structured claims. 1. **Used Attack Technique · 100% confidence · current** LastPass Salesforce data breach through Klue: https://attack.mitre.org/techniques/T1550/001/ 2. **Resulted In · 100% confidence · current** LastPass Salesforce data breach through Klue: Klue’s July 1 summary of CrowdStrike’s investigation reports that a previously compromised GitHub personal access token enabled unauthorized integration-service code on June 11, collecting OAuth access and refresh tokens. How that GitHub token was originally obtained was not established. 3. **Resulted In · 100% confidence · current** LastPass publishes response: LastPass disclosed customer-data access in Salesforce and completed token rotation. 4. **Resulted In · 100% confidence · current** LastPass Salesforce data breach through Klue: An unauthorized actor obtained Klue-held OAuth tokens and used them to access LastPass customer data in Salesforce. 5. **Occurred At · 100% confidence · current** LastPass publishes response: 2026-06-22 6. **Vendor Of · 100% confidence · current** Klue: LastPass 7. **Resulted In · 100% confidence · current** LastPass Salesforce data breach through Klue: LastPass publishes response 8. **Resulted In · 100% confidence · current** LastPass Salesforce data breach through Klue: LastPass rotated exposed tokens and ended employee access to Klue. 9. **Occurred At · 100% confidence · current** LastPass learns of supplier incident: 2026-06-12 10. **Resulted In · 100% confidence · current** LastPass Salesforce data breach through Klue: LastPass said its products, services, infrastructure and customer vaults were unaffected and that it had no evidence of Gong data access. 11. **Used Product · 100% confidence · current** LastPass Salesforce data breach through Klue: Salesforce platform 12. **Resulted In · 100% confidence · current** LastPass learns of supplier incident: LastPass learned of the Klue incident and investigated its connected systems. 13. **Resulted In · 100% confidence · current** LastPass Salesforce data breach through Klue: LastPass learns of supplier incident 14. **Affected Organization · 100% confidence · current** LastPass Salesforce data breach through Klue: LastPass 15. **Resulted In · 100% confidence · current** LastPass Salesforce data breach through Klue: Affected information included names, phone numbers, email and physical addresses, support cases and sales data. 16. **Resulted In · 100% confidence · current** LastPass Salesforce data breach through Klue: Klue said it disabled affected integration workloads and compromised GitHub tokens and rotated OAuth credentials on June 12. 17. **Occurred At · 100% confidence · current** Klue publishes forensic summary: 2026-07-01 18. **Resulted In · 100% confidence · current** Klue publishes forensic summary: Klue published findings from the investigation completed June 30. 19. **Resulted In · 100% confidence · current** LastPass Salesforce data breach through Klue: Klue publishes forensic summary