Key facts: LastPass data breach
- Date discovered: June 12, 2026
- Date reported: June 22, 2026
- Target entity: LastPass
- Source of breach: Third-party supply chain attack (Klue)
- Data types: Customer names, email addresses, phone numbers, physical addresses
- Status: Confirmed; reported on June 22, 2026.
- Severity: Medium; exposure of personally identifiable information (PII) via a third-party vendor incident.
What happened in the LastPass data breach?
LastPass (lastpass.com) reported a supply chain security incident on June 22, 2026. The breach originated from a third-party vendor, Klue, and did not involve a named threat actor at this time. The incident resulted in unauthorized access to customer data within the LastPass Salesforce environment.
The incident involved the theft of OAuth tokens from Klue, which granted attackers access to CRM data without requiring user credentials. Compromised information includes customer names, email addresses, phone numbers, and physical addresses. LastPass confirmed that its core infrastructure and password vaults were not affected by this medium-severity incident. The company has since revoked access and is working with Salesforce and Klue to investigate. Such breaches typically increase the risk of targeted phishing and social engineering attacks against the affected customer base.
Who is behind the incident?
The attacker or cause of the incident has not been identified.
Impact and risks for LastPass customers
Affected customers face risks related to the exposure of contact information. While LastPass password vaults remain secure, the availability of names, emails, and phone numbers allows malicious actors to craft convincing phishing campaigns or SMS-based attacks (smishing). There is an elevated risk of social engineering where attackers may pose as LastPass support to solicit further sensitive information.
Typical outcomes of such exposures include an uptick in spam and targeted fraud. Affected users should enable multi-factor authentication (MFA) on all accounts, remain skeptical of unsolicited communications, and monitor their accounts for suspicious activity. Transparency regarding third-party incidents helps users take timely action to protect their digital identities.
How to protect against similar security incidents
The LastPass breach involved the exposure of contact details through a third-party supply chain attack. While vaults are safe, users should take steps to secure their broader digital footprint.
- Enhance phishing defenses. Be vigilant against emails or texts claiming to be from LastPass or Salesforce. Avoid clicking links or downloading attachments from unverified sources.
- Implement phishing-resistant MFA. Use hardware security keys or authenticator apps rather than SMS-based codes. This provides an extra layer of protection even if your contact details are known to attackers.
- Monitor account activity. Check for unauthorized login attempts on your LastPass account and linked email addresses. Report any suspicious requests for information to LastPass support immediately.
- Manage third-party risks. Organizations should evaluate the security posture of their third-party vendors regularly. Implement continuous attack surface monitoring to identify vulnerabilities in supply chain integrations.
Maintaining proactive security habits is essential for mitigating the impact of third-party data exposures.
Frequently asked questions
What happened in the LastPass security breach?
On June 22, 2026, LastPass (lastpass.com) disclosed a security breach. According to initial reports, a supply chain attack on third-party vendor Klue led to the theft of OAuth tokens, allowing unauthorized access to customer CRM data in the Salesforce environment.
When did the LastPass breach occur?
The LastPass breach was publicly reported on June 22, 2026. The incident was identified by the company on June 12, 2026, though the exact start date of the unauthorized access has not been disclosed.
What data was exposed?
The types of data involved in the LastPass incident include customer names, email addresses, phone numbers, and physical addresses. LastPass stated that core infrastructure and password vaults were not affected.
Is my personal information at risk?
If you interacted with LastPass, there's a possibility your personal information could be affected. Similar incidents often involve email addresses, login details, or financial records. Stay alert for updates and take precautionary measures to secure your accounts.
What steps should companies take after being breached?
LastPass has initiated an incident response process, including revoking compromised OAuth tokens and securing systems. The company is collaborating with Klue and Salesforce for a full investigation and has advised customers on protective measures while deploying enhanced security monitoring.
This cybersecurity news article is powered by UpGuard Breach Risk — continuous attack surface monitoring for your organisation and supply chain.
