1. [News](/news) 2. LastPass data breach exposes customer names and contact information LastPass # LastPass data breach exposes customer names and contact information A data breach involving LastPass was reported in June 2026. See incident details, impact on customers, and recommended security measures. UpGuard Team June 24, 2026 Table of Contents * [What happened in the LastPass data breach?](#what-happened-in-the-lastpass-data-breach) * [Who is behind the incident?](#who-is-behind-the-incident) * [Impact and risks for LastPass customers](#impact-and-risks-for-lastpass-customers) * [How to protect against similar security incidents](#how-to-protect-against-similar-security-incidents) ## Key facts: LastPass data breach * Date discovered June 12, 2026 * Date reported June 22, 2026 * Target entity LastPass * Source of breach Third-party supply chain attack (Klue) * Data types Customer names, email addresses, phone numbers, physical addresses * Status Confirmed; reported on June 22, 2026. * Severity Medium; exposure of personally identifiable information (PII) via a third-party vendor incident. ## What happened in the LastPass data breach? LastPass (lastpass.com) reported a supply chain security incident on June 22, 2026. The breach originated from a third-party vendor, Klue, and did not involve a named threat actor at this time. The incident resulted in unauthorized access to customer data within the LastPass Salesforce environment. The incident involved the theft of OAuth tokens from Klue, which granted attackers access to CRM data without requiring user credentials. Compromised information includes customer names, email addresses, phone numbers, and physical addresses. LastPass confirmed that its core infrastructure and password vaults were not affected by this medium-severity incident. The company has since revoked access and is working with Salesforce and Klue to investigate. Such breaches typically increase the risk of targeted phishing and social engineering attacks against the affected customer base. ## Who is behind the incident? The attacker or cause of the incident has not been identified. ## Impact and risks for LastPass customers Affected customers face risks related to the exposure of contact information. While LastPass password vaults remain secure, the availability of names, emails, and phone numbers allows malicious actors to craft convincing phishing campaigns or SMS-based attacks (smishing). There is an elevated risk of social engineering where attackers may pose as LastPass support to solicit further sensitive information. Typical outcomes of such exposures include an uptick in spam and targeted fraud. Affected users should enable multi-factor authentication (MFA) on all accounts, remain skeptical of unsolicited communications, and monitor their accounts for suspicious activity. Transparency regarding third-party incidents helps users take timely action to protect their digital identities. ## How to protect against similar security incidents The LastPass breach involved the exposure of contact details through a third-party supply chain attack. While vaults are safe, users should take steps to secure their broader digital footprint. * **Enhance phishing defenses.** Be vigilant against emails or texts claiming to be from LastPass or Salesforce. Avoid clicking links or downloading attachments from unverified sources. * **Implement phishing-resistant MFA.** Use hardware security keys or authenticator apps rather than SMS-based codes. This provides an extra layer of protection even if your contact details are known to attackers. * **Monitor account activity.** Check for unauthorized login attempts on your LastPass account and linked email addresses. Report any suspicious requests for information to LastPass support immediately. * **Manage third-party risks.** Organizations should evaluate the security posture of their third-party vendors regularly. Implement continuous attack surface monitoring to identify vulnerabilities in supply chain integrations. > Maintaining proactive security habits is essential for mitigating the impact of third-party data exposures. ## Frequently asked questions ### What happened in the LastPass security breach? On June 22, 2026, LastPass (lastpass.com) disclosed a security breach. According to initial reports, a supply chain attack on third-party vendor Klue led to the theft of OAuth tokens, allowing unauthorized access to customer CRM data in the Salesforce environment. ### When did the LastPass breach occur? The LastPass breach was publicly reported on June 22, 2026. The incident was identified by the company on June 12, 2026, though the exact start date of the unauthorized access has not been disclosed. ### What data was exposed? The types of data involved in the LastPass incident include customer names, email addresses, phone numbers, and physical addresses. LastPass stated that core infrastructure and password vaults were not affected. ### Is my personal information at risk? If you interacted with LastPass, there’s a possibility your personal information could be affected. Similar incidents often involve email addresses, login details, or financial records. Stay alert for updates and take precautionary measures to secure your accounts. ### What steps should companies take after being breached? LastPass has initiated an incident response process, including revoking compromised OAuth tokens and securing systems. The company is collaborating with Klue and Salesforce for a full investigation and has advised customers on protective measures while deploying enhanced security monitoring. ## Is your organization exposed to a similar risk? UpGuard continuously monitors vendors for exposed credentials and infrastructure risk, so you can catch the next breach before it becomes a headline. [Start your free trial](https://cyber-risk.upguard.com/register/trial) ## How secure is LastPass? LastPass provides password management software that creates, stores, and autofills login credentials across devices and browsers. The company offers vault services for passwords and sensitive documents, along with single sign-on (SSO) and multi-factor authentication (MFA) solutions for business customers. * View our free preliminary report on LastPass's security posture * 13 risk factors, including email security, SSL, DNS health, open ports and common vulnerabilities [View LastPass's score View score](/security-report/lastpass) [https://lastpass.com/](/security-report/lastpass) ## Latest news Stay up-to-date with the latest news in cybersecurity. * ### [Hugging Face data breach: key facts and what we know so far](/news/hugging-face-data-breach-2026-07-20) A data breach involving Hugging Face was reported in July 2026. See incident details, impact on customers, and recommended security measures. UpGuard Team July 20, 2026 * ### [EY data breach: what happened and what's at risk](/news/ey-data-breach-2026-07-19) A data breach involving EY was reported in July 2026. See incident details, impact on customers, and recommended security measures. UpGuard Team July 17, 2026 * ### [South Florida Injury & Convenient Care data breach exposes names and Social Security numbers](/news/south-florida-injury-convenient-care-data-breach-2026-07-16) A data breach involving South Florida Injury & Convenient Care was reported in July 2026. See incident details, impact on customers, and security measures. UpGuard Team July 16, 2026 * ### [Park West Psychology data breach: what happened and what's at risk](/news/park-west-psychology-data-breach-2026-07-16) A data breach involving Park West Psychology was reported in July 2026. See incident details, impact on customers, and recommended security measures. UpGuard Team July 16, 2026 * ### [Fall River Municipal Credit Union data breach: what happened and what's at risk](/news/fall-river-municipal-credit-union-data-breach-2026-07-16) A data breach involving Fall River Municipal Credit Union was reported in July 2026. See incident details, impact on customers, and recommended security measures. UpGuard Team July 16, 2026 * ### [NPCIL data breach: World Leaks claims exposure of Kudankulam Nuclear Power Plant files](/news/npcil-data-breach-2026-07-16) A data breach involving NPCIL was reported in July 2026. See incident details, impact on customers, and recommended security measures. UpGuard Team July 16, 2026 [View all news](/news) ## Sign up for our newsletter UpGuard's monthly newsletter cuts through the noise and brings you what matters most: our breaking research, in-depth analysis of emerging threats, and actionable strategic insights.