{ "type": "bundle", "id": "bundle--8a95f186-554b-5349-8b98-bfb958108fdf", "objects": [ { "type": "identity", "spec_version": "2.1", "id": "identity--872ec1f1-fa4e-597b-8250-32944ca6b39f", "created": "2026-09-18T12:00:00Z", "modified": "2026-09-18T12:00:00Z", "x_ally_original_id": "org:e9e064ce-0c28-5c11-9e57-de22c83449e1", "name": "LastPass", "identity_class": "organization" }, { "type": "identity", "spec_version": "2.1", "id": "identity--9608c235-3ee7-5126-8886-6bb7b09d0b8f", "created": "2026-10-13T14:21:17.624648+00:00", "modified": "2026-10-13T14:21:17.624648+00:00", "x_ally_original_id": "org:7fe1fa19-ebf7-413a-8e54-ca4c83acc608", "name": "Klue", "identity_class": "organization" }, { "type": "incident", "spec_version": "2.1", "id": "incident--d6925215-b899-54e6-842e-5fb5657d27b2", "created": "2026-10-13T14:21:17.624648+00:00", "modified": "2026-10-13T14:21:17.624648+00:00", "x_ally_original_id": "brh:34b17964-5296-47b8-8298-fcfcf9e201fb", "name": "LastPass Salesforce data breach through Klue" }, { "type": "incident", "spec_version": "2.1", "id": "incident--ff1952c4-141b-5d1b-8e77-d15c5f713783", "created": "2026-10-13T14:21:17.624648+00:00", "modified": "2026-10-13T14:21:17.624648+00:00", "x_ally_original_id": "inc:e518a3f4-29d7-4ef4-bfb7-c2ff8178f9fd", "name": "LastPass Salesforce data breach through Klue" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--0997cbf4-3d3a-515c-81a5-fbdf37793675", "created": "2026-10-13T14:21:17.624648+00:00", "modified": "2026-10-13T14:21:17.624648+00:00", "x_ally_original_id": "clm:5be1d463-c2b6-4e21-8fd0-0bd818a57941", "relationship_type": "resulted-in", "source_ref": "incident--ff1952c4-141b-5d1b-8e77-d15c5f713783", "target_ref": "x-ally-event--3a0253b1-29a1-50be-8726-ec8914c81440", "confidence": 100, "external_references": [ { "source_name": "LastPass", "url": "https://blog.lastpass.com/posts/klue-supply-chain-incident-and-lastpass-response", "external_id": "cit:25948e3e-21fa-4547-86be-3ab5514a8b10", "x_ally_stance": "supports", "x_ally_snapshot_id": "snp:sha256:5ca1602b1061c9febfc39a1512aaa1b99efbac4afa939e29f7f93db0139ec318" } ] }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--4bc7ea6b-1f3c-5dfa-8a56-90a9d0aa19b0", "created": "2026-10-13T14:21:17.624648+00:00", "modified": "2026-10-13T14:21:17.624648+00:00", "x_ally_original_id": "clm:e8d03f23-eb90-4af5-b01f-37b7351160a9", "relationship_type": "affected-organization", "source_ref": "incident--ff1952c4-141b-5d1b-8e77-d15c5f713783", "target_ref": "identity--872ec1f1-fa4e-597b-8250-32944ca6b39f", "confidence": 100, "external_references": [ { "source_name": "LastPass", "url": "https://blog.lastpass.com/posts/klue-supply-chain-incident-and-lastpass-response", "external_id": "cit:28199808-f17c-4b5f-9016-068d20db7e76", "x_ally_stance": "supports", "x_ally_snapshot_id": "snp:sha256:5ca1602b1061c9febfc39a1512aaa1b99efbac4afa939e29f7f93db0139ec318" } ] }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--51192f66-7bd1-53fd-8dea-650cd20fe037", "created": "2026-10-13T14:21:17.624648+00:00", "modified": "2026-10-13T14:21:17.624648+00:00", "x_ally_original_id": "clm:c7c85fe6-ae59-4ff7-b17b-85eb83590706", "relationship_type": "used-product", "source_ref": "incident--ff1952c4-141b-5d1b-8e77-d15c5f713783", "target_ref": "software--7d8fc2a1-d8c4-5020-80d0-545d273dfa81", "confidence": 100, "external_references": [ { "source_name": "LastPass", "url": "https://blog.lastpass.com/posts/klue-supply-chain-incident-and-lastpass-response", "external_id": "cit:371f5b69-1934-4a11-98ee-cf2ac23d0a55", "x_ally_stance": "supports", "x_ally_snapshot_id": "snp:sha256:5ca1602b1061c9febfc39a1512aaa1b99efbac4afa939e29f7f93db0139ec318" } ] }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--55530d89-7241-5924-8c49-37d6173f16ae", "created": "2026-10-13T14:21:17.624648+00:00", "modified": "2026-10-13T14:21:17.624648+00:00", "x_ally_original_id": "clm:fec1ed2a-f7ab-4530-b0ed-8f75035ad770", "relationship_type": "resulted-in", "source_ref": "incident--ff1952c4-141b-5d1b-8e77-d15c5f713783", "target_ref": "x-ally-event--38aa7b26-8ecf-5c36-8b09-67023e7720ca", "confidence": 100, "external_references": [ { "source_name": "Klue", "url": "https://klue.com/blog/crowdstrike-investigation-summary-and-security-improvements", "external_id": "cit:a4c8b6c9-6937-445f-9611-15d792486b15", "x_ally_stance": "supports", "x_ally_snapshot_id": "snp:sha256:897c4c4d974f8c759bd0faec089b8a6ab701a7e1851be373287f7968944694d6" } ] }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--927367cf-96a1-5edf-8e8e-24118b4df23e", "created": "2026-10-13T14:21:17.624648+00:00", "modified": "2026-10-13T14:21:17.624648+00:00", "x_ally_original_id": "clm:e33d3515-9450-483c-bf42-a6fc2bc45f59", "relationship_type": "resulted-in", "source_ref": "incident--ff1952c4-141b-5d1b-8e77-d15c5f713783", "target_ref": "x-ally-event--9459f2b4-432b-55db-8050-1a7be76cbcae", "confidence": 100, "external_references": [ { "source_name": "LastPass", "url": "https://blog.lastpass.com/posts/klue-supply-chain-incident-and-lastpass-response", "external_id": "cit:d4bcae1c-5ec0-409d-b904-60ab074f7230", "x_ally_stance": "supports", "x_ally_snapshot_id": "snp:sha256:5ca1602b1061c9febfc39a1512aaa1b99efbac4afa939e29f7f93db0139ec318" } ] }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--d91ebda5-bf3d-517d-849f-59b635924456", "created": "2026-10-13T14:21:17.624648+00:00", "modified": "2026-10-13T14:21:17.624648+00:00", "x_ally_original_id": "clm:51dda91b-6417-433a-b08c-610c3af835e7", "relationship_type": "vendor-of", "source_ref": "identity--9608c235-3ee7-5126-8886-6bb7b09d0b8f", "target_ref": "identity--872ec1f1-fa4e-597b-8250-32944ca6b39f", "confidence": 100, "external_references": [ { "source_name": "LastPass", "url": "https://blog.lastpass.com/posts/klue-supply-chain-incident-and-lastpass-response", "external_id": "cit:8843d36f-134d-489f-9344-2d52f390277c", "x_ally_stance": "supports", "x_ally_snapshot_id": "snp:sha256:5ca1602b1061c9febfc39a1512aaa1b99efbac4afa939e29f7f93db0139ec318" } ] }, { "type": "software", "spec_version": "2.1", "id": "software--7d8fc2a1-d8c4-5020-80d0-545d273dfa81", "created": "2026-08-09T07:15:01Z", "modified": "2026-08-09T07:15:01Z", "x_ally_original_id": "prd:5f51ceea-083a-473e-82cd-ca4db46f6bc8", "name": "Salesforce platform" }, { "type": "x-ally-claim", "spec_version": "2.1", "id": "x-ally-claim--074db1ce-07d0-5876-856b-a64f73bd32a9", "created": "2026-10-13T14:21:17.624648+00:00", "modified": "2026-10-13T14:21:17.624648+00:00", "x_ally_original_id": "clm:e9bfe0e7-e9cb-4ed6-a4c7-5463fcbe6ca2", "confidence": 100, "external_references": [ { "source_name": "LastPass", "url": "https://blog.lastpass.com/posts/klue-supply-chain-incident-and-lastpass-response", "external_id": "cit:a6fe033c-2d08-444f-ac8c-e1604adf8d30", "x_ally_stance": "supports", "x_ally_snapshot_id": "snp:sha256:5ca1602b1061c9febfc39a1512aaa1b99efbac4afa939e29f7f93db0139ec318" } ], "x_ally_claim_object": { "kind": "value", "datatype": "string", "value": "Affected information included names, phone numbers, email and physical addresses, support cases and sales data." } }, { "type": "x-ally-claim", "spec_version": "2.1", "id": "x-ally-claim--10983eb7-e555-5519-8420-5f1dc18a0446", "created": "2026-10-13T14:21:17.624648+00:00", "modified": "2026-10-13T14:21:17.624648+00:00", "x_ally_original_id": "clm:f2af173d-d8c8-4fbf-9ff3-f88914c7333f", "confidence": 100, "external_references": [ { "source_name": "Klue", "url": "https://klue.com/blog/crowdstrike-investigation-summary-and-security-improvements", "external_id": "cit:0ceff67a-8eb2-4d58-aacf-ea7fd6c8ef9f", "x_ally_stance": "supports", "x_ally_snapshot_id": "snp:sha256:897c4c4d974f8c759bd0faec089b8a6ab701a7e1851be373287f7968944694d6" } ], "x_ally_claim_object": { "kind": "value", "datatype": "date", "value": "2026-07-01" } }, { "type": "x-ally-claim", "spec_version": "2.1", "id": "x-ally-claim--12513239-8435-5118-8682-4c9ad6aa5c96", "created": "2026-10-13T14:21:17.624648+00:00", "modified": "2026-10-13T14:21:17.624648+00:00", "x_ally_original_id": "clm:aaf7642f-d55f-49bb-9a59-6a0bc02a13b9", "confidence": 100, "external_references": [ { "source_name": "LastPass", "url": "https://blog.lastpass.com/posts/klue-supply-chain-incident-and-lastpass-response", "external_id": "cit:9cb2e03a-5625-4399-b436-941698f3c6e7", "x_ally_stance": "supports", "x_ally_snapshot_id": "snp:sha256:5ca1602b1061c9febfc39a1512aaa1b99efbac4afa939e29f7f93db0139ec318" } ], "x_ally_claim_object": { "kind": "value", "datatype": "date", "value": "2026-06-12" } }, { "type": "x-ally-claim", "spec_version": "2.1", "id": "x-ally-claim--3fef9b1f-3462-5316-8775-24673e65e95c", "created": "2026-10-13T14:21:17.624648+00:00", "modified": "2026-10-13T14:21:17.624648+00:00", "x_ally_original_id": "clm:143a38d4-a604-4426-a685-d632a02d2960", "confidence": 100, "external_references": [ { "source_name": "Klue", "url": "https://klue.com/blog/crowdstrike-investigation-summary-and-security-improvements", "external_id": "cit:78d57e76-2209-442d-8ffe-276caffc9bad", "x_ally_stance": "supports", "x_ally_snapshot_id": "snp:sha256:897c4c4d974f8c759bd0faec089b8a6ab701a7e1851be373287f7968944694d6" } ], "x_ally_claim_object": { "kind": "value", "datatype": "string", "value": "Klue’s July 1 summary of CrowdStrike’s investigation reports that a previously compromised GitHub personal access token enabled unauthorized integration-service code on June 11, collecting OAuth access and refresh tokens. How that GitHub token was originally obtained was not established." } }, { "type": "x-ally-claim", "spec_version": "2.1", "id": "x-ally-claim--6866b0bd-1842-554a-83cc-3c0a0cfdc4c3", "created": "2026-10-13T14:21:17.624648+00:00", "modified": "2026-10-13T14:21:17.624648+00:00", "x_ally_original_id": "clm:f2fe8069-0553-4ae0-9c81-8b061d619871", "confidence": 100, "external_references": [ { "source_name": "Klue", "url": "https://klue.com/blog/crowdstrike-investigation-summary-and-security-improvements", "external_id": "cit:40470655-e66e-4a22-91be-aded2424088d", "x_ally_stance": "supports", "x_ally_snapshot_id": "snp:sha256:897c4c4d974f8c759bd0faec089b8a6ab701a7e1851be373287f7968944694d6" } ], "x_ally_claim_object": { "kind": "value", "datatype": "string", "value": "Klue published findings from the investigation completed June 30." } }, { "type": "x-ally-claim", "spec_version": "2.1", "id": "x-ally-claim--6c101e08-e951-5386-8f07-123eba4ba3ef", "created": "2026-10-13T14:21:17.624648+00:00", "modified": "2026-10-13T14:21:17.624648+00:00", "x_ally_original_id": "clm:0cb621c2-3394-45cb-9a8f-fea4da8c6dbd", "confidence": 100, "external_references": [], "x_ally_claim_object": { "kind": "iri", "value": "https://attack.mitre.org/techniques/T1550/001/" } }, { "type": "x-ally-claim", "spec_version": "2.1", "id": "x-ally-claim--706f2570-371e-561d-81da-7a26522219de", "created": "2026-10-13T14:21:17.624648+00:00", "modified": "2026-10-13T14:21:17.624648+00:00", "x_ally_original_id": "clm:2c6bac09-f880-416e-ad4c-547397092e48", "confidence": 100, "external_references": [ { "source_name": "LastPass", "url": "https://blog.lastpass.com/posts/klue-supply-chain-incident-and-lastpass-response", "external_id": "cit:936c8cb2-5b95-4a1b-bbd9-d623b5559eb4", "x_ally_stance": "supports", "x_ally_snapshot_id": "snp:sha256:5ca1602b1061c9febfc39a1512aaa1b99efbac4afa939e29f7f93db0139ec318" } ], "x_ally_claim_object": { "kind": "value", "datatype": "date", "value": "2026-06-22" } }, { "type": "x-ally-claim", "spec_version": "2.1", "id": "x-ally-claim--93229469-2cbb-5434-86bf-4f28ef55aa23", "created": "2026-10-13T14:21:17.624648+00:00", "modified": "2026-10-13T14:21:17.624648+00:00", "x_ally_original_id": "clm:25073a74-4ea4-419a-98b5-4951860de77e", "confidence": 100, "external_references": [ { "source_name": "LastPass", "url": "https://blog.lastpass.com/posts/klue-supply-chain-incident-and-lastpass-response", "external_id": "cit:79da3c35-6158-4c78-b92a-70611286b125", "x_ally_stance": "supports", "x_ally_snapshot_id": "snp:sha256:5ca1602b1061c9febfc39a1512aaa1b99efbac4afa939e29f7f93db0139ec318" } ], "x_ally_claim_object": { "kind": "value", "datatype": "string", "value": "An unauthorized actor obtained Klue-held OAuth tokens and used them to access LastPass customer data in Salesforce." } }, { "type": "x-ally-claim", "spec_version": "2.1", "id": "x-ally-claim--c6f79f14-7eac-5a27-8986-1b169cf8ec6e", "created": "2026-10-13T14:21:17.624648+00:00", "modified": "2026-10-13T14:21:17.624648+00:00", "x_ally_original_id": "clm:f08141d1-2da2-4886-9356-633e6cf3eeb0", "confidence": 100, "external_references": [ { "source_name": "Klue", "url": "https://klue.com/blog/crowdstrike-investigation-summary-and-security-improvements", "external_id": "cit:c093f11c-9669-440b-8e7d-78f7076371a3", "x_ally_stance": "supports", "x_ally_snapshot_id": "snp:sha256:897c4c4d974f8c759bd0faec089b8a6ab701a7e1851be373287f7968944694d6" } ], "x_ally_claim_object": { "kind": "value", "datatype": "string", "value": "Klue said it disabled affected integration workloads and compromised GitHub tokens and rotated OAuth credentials on June 12." } }, { "type": "x-ally-claim", "spec_version": "2.1", "id": "x-ally-claim--d0e93b15-6cfe-55a5-8fe4-281450bd9f1d", "created": "2026-10-13T14:21:17.624648+00:00", "modified": "2026-10-13T14:21:17.624648+00:00", "x_ally_original_id": "clm:d5953acf-4a5e-402c-b2ce-b612e8c1a470", "confidence": 100, "external_references": [ { "source_name": "LastPass", "url": "https://blog.lastpass.com/posts/klue-supply-chain-incident-and-lastpass-response", "external_id": "cit:6b20f749-7583-4286-becc-2df6d98dc8f6", "x_ally_stance": "supports", "x_ally_snapshot_id": "snp:sha256:5ca1602b1061c9febfc39a1512aaa1b99efbac4afa939e29f7f93db0139ec318" } ], "x_ally_claim_object": { "kind": "value", "datatype": "string", "value": "LastPass learned of the Klue incident and investigated its connected systems." } }, { "type": "x-ally-claim", "spec_version": "2.1", "id": "x-ally-claim--d199396e-d594-5cdb-8ef6-28257533efc1", "created": "2026-10-13T14:21:17.624648+00:00", "modified": "2026-10-13T14:21:17.624648+00:00", "x_ally_original_id": "clm:23524f8d-1e39-4228-83ce-a28b2e59c992", "confidence": 100, "external_references": [ { "source_name": "LastPass", "url": "https://blog.lastpass.com/posts/klue-supply-chain-incident-and-lastpass-response", "external_id": "cit:c41b9c37-d4fa-4cae-a42a-aae1e8638d28", "x_ally_stance": "supports", "x_ally_snapshot_id": "snp:sha256:5ca1602b1061c9febfc39a1512aaa1b99efbac4afa939e29f7f93db0139ec318" } ], "x_ally_claim_object": { "kind": "value", "datatype": "string", "value": "LastPass disclosed customer-data access in Salesforce and completed token rotation." } }, { "type": "x-ally-claim", "spec_version": "2.1", "id": "x-ally-claim--daa057b2-e0fd-52d6-8a1d-96206522e4b9", "created": "2026-10-13T14:21:17.624648+00:00", "modified": "2026-10-13T14:21:17.624648+00:00", "x_ally_original_id": "clm:ad75fb93-4af5-4434-829e-0ab8937bdd91", "confidence": 100, "external_references": [ { "source_name": "LastPass", "url": "https://blog.lastpass.com/posts/klue-supply-chain-incident-and-lastpass-response", "external_id": "cit:46f18438-155a-4c48-bad3-fad8d209bee7", "x_ally_stance": "supports", "x_ally_snapshot_id": "snp:sha256:5ca1602b1061c9febfc39a1512aaa1b99efbac4afa939e29f7f93db0139ec318" } ], "x_ally_claim_object": { "kind": "value", "datatype": "string", "value": "LastPass said its products, services, infrastructure and customer vaults were unaffected and that it had no evidence of Gong data access." } }, { "type": "x-ally-claim", "spec_version": "2.1", "id": "x-ally-claim--dcfe5bc5-d0c2-5322-801b-6ecc2f79ac40", "created": "2026-10-13T14:21:17.624648+00:00", "modified": "2026-10-13T14:21:17.624648+00:00", "x_ally_original_id": "clm:a392759a-9dc8-426e-852c-a92b30ada2e8", "confidence": 100, "external_references": [ { "source_name": "LastPass", "url": "https://blog.lastpass.com/posts/klue-supply-chain-incident-and-lastpass-response", "external_id": "cit:3fe93383-00ac-41f5-88dd-c39787e8a36a", "x_ally_stance": "supports", "x_ally_snapshot_id": "snp:sha256:5ca1602b1061c9febfc39a1512aaa1b99efbac4afa939e29f7f93db0139ec318" } ], "x_ally_claim_object": { "kind": "value", "datatype": "string", "value": "LastPass rotated exposed tokens and ended employee access to Klue." } }, { "type": "x-ally-event", "spec_version": "2.1", "id": "x-ally-event--38aa7b26-8ecf-5c36-8b09-67023e7720ca", "created": "2026-10-13T14:21:17.624648+00:00", "modified": "2026-10-13T14:21:17.624648+00:00", "x_ally_original_id": "evt:53f9033a-cbc3-4b5c-a714-66277b64e062", "name": "Klue publishes forensic summary" }, { "type": "x-ally-event", "spec_version": "2.1", "id": "x-ally-event--3a0253b1-29a1-50be-8726-ec8914c81440", "created": "2026-10-13T14:21:17.624648+00:00", "modified": "2026-10-13T14:21:17.624648+00:00", "x_ally_original_id": "evt:e829cc27-9c49-4030-82e1-8f097a899f61", "name": "LastPass publishes response" }, { "type": "x-ally-event", "spec_version": "2.1", "id": "x-ally-event--9459f2b4-432b-55db-8050-1a7be76cbcae", "created": "2026-10-13T14:21:17.624648+00:00", "modified": "2026-10-13T14:21:17.624648+00:00", "x_ally_original_id": "evt:cc44b48f-2fd8-4735-8553-9dc91f995b86", "name": "LastPass learns of supplier incident" } ] }