LastPass Confirms Customer Data Breach After Klue OAuth Token Theft

LastPass confirmed that the Klue supply-chain compromise allowed an unauthorized actor (identified as the Icarus extortion group) to harvest stolen OAuth tokens from Klue and use them to access and copy CRM data from LastPass's Salesforce environment; LastPass rotated tokens, cut employee access to Klue, published IOCs, and advised customers to review integrations and watch for phishing and social-engineering attempts.