According to TechCrunch, market intelligence platform Klue confirmed hackers broke into its systems on June 12 and stole data from some customers, with affected customers including Gong, Jamf, HackerOne, LastPass, Recorded Future, Snyk and Tanium [2]. According to BleepingComputer, the Icarus extortion group used compromised legacy integration credentials to obtain OAuth tokens held by Klue and accessed LastPass's Salesforce environment, exposing customer names, phone numbers, emails, addresses and support case data, while LastPass said vaults were not affected [1]. BleepingComputer advises LastPass users to be cautious of unsolicited phone or email communications requesting sensitive details and never share their master password [1].
This event has not been officially confirmed. Content is based on media or third-party reports.
Backfill: this event became public on Jun 22, 2026 and we added it on Nov 11, 2026. It is not a new event.
HighMonitoringBackfillMedia reported
Klue breach leaks OAuth tokens, exposing Salesforce data at LastPass and other firms
1 min read
- Disclosed
- Jun 22, 2026
- Occurred
- Jun 12, 2026
- Published
- Nov 11, 2026
- Last updated
- Nov 11, 2026
- CVSS basis
- Our assessment
- Technology
- Attack vector
- Impact
- Data type
- Actor type
- Motivation
On this page
30-second summary
Timeline
Technical details
Remediation
Vendor guidance
- 1Beware of social engineering verify[1]
Be cautious of unsolicited requests for sensitive details and never share your master password.
References
Media2
- [1]BleepingComputer2026-06-23Accessed 2026-11-11Snapshot 2026-11-11 sha256 c6b4fb7b08e8
“LastPass announced that hackers accessed support cases containing customer data from its Salesforce environment after stealing the company's OAuth tokens in the Klue supply chain attack earlier this month.”
- [2]
This site aggregates public information and is not security consulting advice. Test remediation steps before applying.