LastPass Customer Data Exposed in Klue Supply Chain Attack

LastPass disclosed a supply-chain security incident stemming from its third-party vendor Klue, where stolen OAuth tokens were used to access LastPass' Salesforce instance and exfiltrate customer CRM data (names, emails, phone numbers, addresses, support and sales records). The company states core products and password vaults were not affected, has revoked Klue access and rotated tokens, engaged Klue/Salesforce and law enforcement, and published IOCs (several IPs and suspicious sender domains) while warning customers to be wary of phishing.