- Attackers compromised Klue, a third-party market intelligence platform, and used stolen OAuth tokens to access customer data stored in LastPass’s Salesforce environment.
- The exposed records include customer names, email addresses, phone numbers, physical addresses, and sales-related CRM data.
- LastPass confirmed that the breach did not affect its password vault infrastructure, but warned customers to stay alert for phishing and social engineering attempts using the stolen contact information.
LastPass has disclosed that attackers accessed customer contact and CRM data after compromising Klue, a third-party competitive intelligence platform connected to its go-to-market operations. The company received notification of the breach on June 12.
Klue integrates with Salesforce and Gong, and during the attack, threat actors obtained OAuth tokens that Klue maintained on behalf of multiple customers and used those credentials to extract data from affected organizations’ Salesforce environments, including LastPass.
LastPass confirmed that the compromise was limited to systems connected to Klue and did not affect its core products, internal infrastructure, or customer password vaults. The company also stated that no evidence exists of attackers accessing data from its Gong deployment.
For a company whose reputation rests on securing millions of consumer and business credentials in encrypted vaults, the clarification carries significant weight.
How Attackers Broke Into Klue’s Backend
ReliaQuest Threat researchers provided a detailed account of how the attack unfolded. According to their analysis, the attackers took advantage of jeopardized Klue integration profiles to get OAuth tokens for their large-scale data harvesting via the REST API on Salesforce.
The group utilized automated Python-built tooling to enumerate Salesforce objects and run thousands of API queries over extended periods, pulling CRM records at scale without triggering immediate detection.
Huntress, another organization affected by the same incident, reported that attackers initially gained access through an old credential created for a discontinued integration project on Klue’s backend. From there, the attackers deployed code to harvest OAuth tokens from Klue’s customers and used those credentials to query and extract Salesforce data directly from victim environments.
Salesforce confirmed it had disabled the Klue Battlecards application connection across customer environments after fishing out sketchy activity. The company stated the issue started from the integration of Klue and did not stem from any vulnerability in the Salesforce platform itself.
A New Threat Group Claims Responsibility
ReliaQuest noted that the attack pattern closely resembles previous campaigns targeting third-party providers within the Salesforce ecosystem, including Salesloft, Drift, and Gainsight. Earlier campaigns in that series carried links to financially inspired cyber thieves, ShinyHunters, and UNC6395. The most recent hit, however, carries a different name.
A new threat group calling itself “Icarus” has claimed responsibility, stating that it exfiltrated data from multiple Salesforce environments belonging to Klue customers and encouraged affected organizations to contact them regarding the stolen records.
The group’s claims and activities are currently being investigated by Klue, which has launched a probe into the breach allegations following its appearance on the Icarus leak site.
On June 22, data allegedly pulled from multiple Klue customers began appearing on the Icarus leak site. Several organizations affected by the incident have already reported receiving extortion emails, confirming that the threat actors are actively leveraging the stolen data.
What was Exposed and What Customers Should Do
The stolen information consists primarily of business contact and CRM records. According to LastPass, the exposed data includes customer names, email addresses, phone numbers, physical addresses, support case information, and sales-related data. The breach did not include password vault contents, and LastPass emphasized that attackers did not compromise any customer secrets stored in its password management service.
That distinction matters, but the exposed records still carry meaningful risk. Cybersecurity researchers consistently flag datasets that combine verified contact details with business relationship context as valuable raw material for phishing campaigns, social engineering attacks, and targeted extortion attempts.
In response, LastPass revoked employee access to Klue, rotated all exposed API tokens, launched an internal investigation, and notified law enforcement. The company also said it is sharing threat intelligence through its Threat Intelligence, Mitigation, and Escalation (TIME) team to help disrupt the ongoing campaign and support broader industry defenses.
LastPass advised its customers to remain alert for suspicious emails, unexpected phone calls, and other contact attempts that may draw on the exposed information. The company reminded users that LastPass employees will never request master passwords under any circumstances, and that all legitimate communications will come through official support channels.
