LastPass User Data Stolen by Hackers Again
LastPass said the exposed data included names, phone numbers, email addresses and support case records after hackers used a 2022 pilot credential.
- LastPass is warning users about a data breach involving partner Vancouver-based Klue, which detected the incident on June 12 and disclosed it last Friday, exposing customer information and support case data.
- Klue confirmed hackers used a legacy credential dating to 2022 from a limited pilot program to infiltrate its systems, exploiting OAuth tokens to access customer data stored in external clouds and databases.
- A hacking group called Icarus claimed responsibility for the breach, threatening to release stolen CRM data, support cases, and business contact information including customer names, phone numbers, and email addresses if ransom demands go unpaid.
- After learning of the incident, LastPass revoked employee access to Klue and rotated exposed API tokens, while recommending customers "remain vigilant of potential phishing attacks or social engineering attempts."
- Klue spokesperson Katie Berg stated the company is conducting a "comprehensive review of credential management, vendor-access controls, monitoring capabilities, and deployment security processes," though questions remain as the investigation continues.
34 Articles
34 Articles
LastPass data breach confirmed: Everything we know so far
A security breach at a third-party vendor has exposed customer data belonging to LastPass, the company confirmed this week, in the latest incident to put the beleaguered password manager back in the spotlight.LastPass confirmed this week that hackers gained access through a company called Klue, a market intelligence tool that LastPass uses internally to track competitors and manage sales relationships. According to LastPass, an unauthorized acto…
LastPass customer names, emails, and support records stolen in third-party breach, vaults unaffected
The good news for anyone still using LastPass after its previous security disasters is that this was not a compromise of the company's password manager infrastructure. LastPass says customer vaults remain secure, and its products and services were not affected.Read Entire Article
LastPass has suffered another data breach. Cybercriminals have explored a vulnerability in Klue, a company service provider, to access customer information about the password manager.
Coverage Details
Bias Distribution
- 67% of the sources are Center
Factuality
To view factuality data please Upgrade to Premium
