LastPass customers' data exposed in breach at third-party technology partner

Password manager provider LastPass is notifying its customer base of a data breach that resulted in the theft of customer information and support records. The breach did not affect LastPass’s own systems but rather occurred at Klue, a technology partner the company uses.

Hackers who gained access to Klue’s infrastructure extracted an extensive array of personal data belonging to LastPass customers, including names, phone numbers, email addresses and physical addresses. The attackers also obtained customer support case records and sales-related information. LastPass said its infrastructure remained intact and that customer password vaults were not compromised.

The scope of the incident extends beyond LastPass. Several other cybersecurity companies, including HackerOne, Recorded Future and Tanium, have also reported data theft stemming from the same breach at Klue.

Klue CEO Jason Smith disclosed that the company identified suspicious activity in its systems on June 12. A hacking group operating under the name Icarus claimed responsibility for the breach and has publicly stated that it will release the stolen data if a ransom is not paid. Neither Smith nor LastPass representatives responded to requests for information about the number of affected customers.

The data stolen in the incident is believed to contain fragments of sensitive information. Customer support case records typically include details about billing issues and account access problems but can also contain credentials and government-issued identification documents from previous incidents.

The breach marks another security incident for LastPass, which disclosed a major breach in 2022. In that incident, hackers stole the complete repository of customer password vaults. Although the vaults were protected by master passwords known only to individual customers, attackers were able to crack weaker passwords offline and access the encrypted contents. The 2022 breach was subsequently linked to several cryptocurrency thefts, with hackers suspected of obtaining digital wallet keys from compromised password vaults.

LastPass operates a customer base exceeding 33 million users and approximately 1.6 million paying subscribers as of 2024.