LastPass Customer Data Stolen in Third-Party Breach Again

LastPass is notifying customers that their personal information and customer support case records were stolen during a breach at Klue, a market research company that serves technology firms. This marks the latest in a series of data compromises affecting the password manager, underscoring a broader problem: when your job is protecting other people's secrets, even indirect security failures can be catastrophic.

The breach occurred at Klue's systems, not LastPass's own infrastructure, a crucial distinction that LastPass is emphasizing. The company's core product, the encrypted password vaults that store customer credentials, was not compromised. But that distinction provides only limited reassurance when customer support case files contain the kinds of information that typically flows through them.

What Was Actually Compromised

LastPass confirmed that hackers stole customer names, phone numbers, email addresses, physical addresses, customer support case data, and sales-related information. The password vaults remain encrypted and uncompromised, which is significant; however, the support case data is a different story.

What's in a customer support ticket? Often, the kinds of things people only share when they're locked out of their account or dealing with billing issues. Past breaches involving support case data have included fragments of credentials, identity documents, and other sensitive information that customers wouldn't have voluntarily shared with attackers. The full scope of what's in LastPass's support tickets isn't yet clear, and LastPass hasn't provided specifics about how many customers are affected.

The Supply Chain Angle

LastPass is the latest in a growing roster of cybersecurity companies compromised by the same Klue breach. HackerOne, Recorded Future, and Tanium have also been affected, according to reporting from the same breach that Klue disclosed last week. Project E Beauty

The irony is sharp: companies in the business of securing other people's digital assets and infrastructure are themselves getting breached through third-party vendors. It's the supply chain vulnerability problem in miniature, even if your own security is solid, a partner's compromise can expose your customers anyway.

Context: LastPass's Troubled History

This isn't LastPass's first significant data breach. The company previously experienced a major breach in 2022 in which hackers stole the company's entire store of customer password vaults. While those vaults were encrypted with customer master passwords, the encryption wasn't strong enough to withstand determined offline cracking attempts, particularly when customers used weak master passwords. Several cryptocurrency thefts were later linked to the LastPass breach after hackers were suspected of stealing victims' wallet keys by cracking their password vaults. Project E BeautyProject E Beauty

That earlier breach exposed the core vulnerability in LastPass's security model: even with encryption, the company's entire customer database became a target for attackers with sufficient resources and patience. The 2022 incident damaged customer trust significantly and prompted many users to migrate to alternative password managers that offered better security practices.

This new breach, while not directly affecting the vaults themselves, compounds that existing damage. Customers already skeptical of LastPass's security practices now have further evidence of the company's difficulty maintaining the kind of perimeter security that should be table stakes for a password manager.

The Attribution and Extortion

Klue CEO Jason Smith said the company identified hackers in its systems on June 12. A hacking and extortion group called Icarus took credit for the breach and has publicly threatened to release the stolen data if a ransom isn't paid. Project E Beauty

This extortion threat adds another layer of risk the data is now in the hands of actors who've explicitly signaled their willingness to sell or publish it if their financial demands aren't met. Whether Klue, LastPass, or any of the other affected companies negotiate with extortionists typically remains undisclosed, but the public threat itself means the data's exposure is now a matter of time rather than possibility.

What LastPass Is Saying

LastPass emphasized that the company's own infrastructure was unaffected, including customers' password vaults. Spokespeople for LastPass did not immediately respond to requests for comment or questions about how many customers are affected, a notable silence given the public announcement. Project E Beauty

LastPass has roughly 33 million users overall and around 1.6 million paying customers, according to its own data from 2024. Even if only a fraction of those are affected, the customer support data exposure is real, and the timeline for potential public release is uncertain.

What This Means for Password Manager Users

For users, the immediate risk is relatively contained. LastPass's vaults are uncompromised, meaning credentials stored within them remain encrypted and inaccessible. The stolen customer support data is concerning mainly to the extent that it might contain fragments of sensitive information users shared with support, but it's not direct access to password vaults themselves.

For LastPass's market position, this is more damaging. The company was already rebuilding trust after the 2022 breach. This new incident, while less serious than the previous one, reinforces a pattern: LastPass's perimeter security cannot be relied upon the way a password manager company's security absolutely must be.

Users who migrated away after 2022 have little reason to return. New users considering LastPass have clear evidence of a company that, even if its core vault encryption is solid, maintains broader infrastructure vulnerabilities that expose customer data with distressing regularity.

The Broader Pattern

The Klue breach affecting multiple cybersecurity companies simultaneously is a reminder that supply chain vulnerabilities don't disappear just because you have good security practices. A third-party vendor's compromise can expose your data regardless of your own diligence, which is exactly why critical infrastructure and security-sensitive companies are increasingly demanding that their vendors meet extraordinarily high security standards.

For password managers specifically, the bar is even higher. These companies hold keys to the kingdom. Anything less than fortress-level security at every layer of vendors, support systems, and infrastructure is fundamentally incompatible with the trust the product demands.