LastPass has confirmed that attackers accessed customer CRM records after compromising Klue, a third-party sales intelligence platform connected through OAuth.
While customer password vaults were not affected, customer names, contact details, support cases, and CRM records may have been exposed.
This incident highlights an important security lesson:
Third-party SaaS integrations are part of your security boundary.
The article explains:
How the OAuth token compromise happened
Why LastPass vaults were not affected
Why developers immediately referenced the 2022 breach
Practical security lessons for engineering teams managing SaaS integrations
Read the full analysis:
https://blog.invidelabs.com/lastpass-customer-data-breach-2026-klue/
Top comments (0)