LastPass disclosed that unauthorized parties reached customer records stored in its Salesforce environment after acquiring OAuth tokens through the Klue supply chain breach that took place earlier this month.

The password manager emphasized that its core products, services, and infrastructure stayed untouched during the event, with all customer vaults remaining fully protected.

On June 12, LastPass learned of an incident at Klue, a third-party market intelligence service used by its sales teams that connects to Salesforce and Gong platforms.

The company immediately began an internal review and discovered that an attacker had obtained OAuth tokens held by Klue for multiple clients, including LastPass itself.

Those stolen credentials allowed the intruder to view LastPass customer records inside the Salesforce platform.

The review found no signs that any Gong-related information, such as customer calls or emails, had been accessed.

LastPass stated that the following details may have been exposed: customer names, phone numbers, email addresses, physical addresses, support case details, and sales or CRM records.

Attackers could use this information for phishing or social engineering attempts. Users are advised to remain alert to unexpected phone calls or emails asking for sensitive data and to never share master passwords.

The Klue supply chain attack was claimed by the Icarus extortion group, which infiltrated the platform and stole OAuth tokens linked to customer Salesforce instances.

Icarus accessed Klue infrastructure through compromised legacy credentials for an integration service, gaining the tokens that connected Klue to external platforms.

Multiple organizations were affected, including Recorded Future, Tanium, Jamf, Sprout Social, Gong, and Insurity.

The threat actor removed CRM data and began an extortion effort.

LastPass has revoked employee access to Klue, rotated the exposed tokens, and contacted law enforcement as the investigation continues.

The firm also cautioned users about messages from sender domains baccarat.com.au, robinskitchen.com.au, and house.com.au, stressing that only official support channels should be trusted.