LastPass Warns Users of Third-Party Breach Exposing Personal Data
LastPass has notified customers that their personal information was compromised in a June 11 breach of Klue, a third-party market intelligence firm. The stolen data includes names, phone numbers, email and physical addresses, as well as support case and sales-related records. While LastPass emphasized that its own systems and customer vaults remain unaffected, the incident has raised concerns about downstream risks.
The cybercrime group Icarus has claimed responsibility for the attack and is reportedly contacting users with threats to leak their data. Multiple cybersecurity firms using Klue have also experienced data exposure, increasing the potential for phishing and social engineering attacks targeting affected individuals.
The breach adds to LastPass’s troubled security history, particularly its 2022 incidents, which resulted in significant financial losses. Ripple co-founder Chris Larsen lost $150 million in crypto after his private keys were exposed in the 2022 breach. Cybersecurity researcher ZachXBT later linked the incident to additional thefts, including $5.4 million from over 40 addresses in 2024 and $4.4 million from 25 victims in 2023. Two individuals tied to the "AudiA6" crypto-laundering operation were also found to have processed stolen funds from LastPass users.
Last year, the UK’s Information Commissioner’s Office fined LastPass £1.2 million for the 2022 breach, citing inadequate security measures that allowed unauthorized access to its backup database, impacting 1.6 million UK users.
Source: https://protos.com/lastpass-customer-info-leaked-again-after-third-party-data-breach/
LastPass cybersecurity rating report: https://www.rankiteo.com/company/lastpass
Klue cybersecurity rating report: https://www.rankiteo.com/company/klue
"id": "LASKLU1782319113",
"linkid": "lastpass, klue",
"type": "Breach",
"date": "6/2026",
"severity": "85",
"impact": "4",
"explanation": "Attack with significant impact with customers data leaks"{'affected_entities': [{'industry': 'Cybersecurity (Password Management)',
'name': 'LastPass',
'type': 'Company'},
{'customers_affected': 'Multiple cybersecurity firms',
'industry': 'Market Intelligence',
'name': 'Klue',
'type': 'Company'}],
'attack_vector': 'Third-party breach',
'customer_advisories': 'Warnings about phishing and social engineering risks',
'data_breach': {'data_exfiltration': 'Yes',
'personally_identifiable_information': 'Yes (names, phone '
'numbers, email and '
'physical addresses)',
'sensitivity_of_data': 'Moderate (PII)',
'type_of_data_compromised': 'Personal information (names, '
'phone numbers, email and '
'physical addresses, support case '
'and sales-related records)'},
'date_detected': '2024-06-11',
'description': 'LastPass has notified customers that their personal '
'information was compromised in a June 11 breach of Klue, a '
'third-party market intelligence firm. The stolen data '
'includes names, phone numbers, email and physical addresses, '
'as well as support case and sales-related records. While '
'LastPass emphasized that its own systems and customer vaults '
'remain unaffected, the incident has raised concerns about '
'downstream risks. The cybercrime group Icarus has claimed '
'responsibility for the attack and is reportedly contacting '
'users with threats to leak their data. Multiple cybersecurity '
'firms using Klue have also experienced data exposure, '
'increasing the potential for phishing and social engineering '
'attacks targeting affected individuals.',
'impact': {'brand_reputation_impact': 'Yes',
'data_compromised': 'Personal information (names, phone numbers, '
'email and physical addresses, support case '
'and sales-related records)',
'identity_theft_risk': 'Yes',
'legal_liabilities': 'Yes (UK ICO fine)',
'systems_affected': 'Klue (third-party market intelligence firm)'},
'motivation': 'Data exfiltration, extortion',
'post_incident_analysis': {'root_causes': 'Third-party vendor compromise '
'(Klue)'},
'references': [{'source': 'LastPass Customer Notification'}],
'regulatory_compliance': {'fines_imposed': '£1.2 million (for 2022 breach)',
'regulations_violated': 'UK Data Protection Act '
'(via ICO)'},
'response': {'communication_strategy': 'Customer notifications'},
'threat_actor': 'Icarus',
'title': 'LastPass Warns Users of Third-Party Breach Exposing Personal Data',
'type': 'Data Breach'}