LastPass has confirmed a data breach in which attackers compromised its Salesforce environment by exploiting stolen OAuth tokens from a supply chain attack on Klue, a competitive intelligence platform the company uses internally. LastPass disclosed the incident on its blog on 22 June 2026, with additional reporting by BleepingComputer on 23 June 2026.

How the Attack Worked

The attack followed a pattern that has become routine in enterprise breaches: instead of targeting LastPass directly, the threat actors compromised a third-party vendor, harvested valid OAuth tokens from that environment, and used them to authenticate into LastPass's Salesforce instance. OAuth tokens are credentials that let one application request access to another on behalf of a user. When stolen, they grant session-level access without requiring a password — the attacker simply reuses a token that was legitimately issued to a vendor, making detection far harder than a typical credential theft.

Klue is a SaaS platform that aggregates competitive data and surfaces it for sales and product teams. It typically integrates deeply into a company's CRM stack, particularly Salesforce, which dominates enterprise customer-relationship management. A compromise at the Klue layer translates directly into CRM access. LastPass has not publicly specified which categories of customer data were exposed in Salesforce — though a password-management firm's CRM environment would routinely contain customer account metadata, support history, and contact records.

Pattern and Context

This is the third distinct security incident LastPass has faced in recent years. The 2022 breaches compromised the developer environment, then source code and encrypted customer vault data. Each incident has targeted a different attack surface, making it difficult to characterize as a single systemic failure. Still, the pattern is worth noting for a company whose core product promise is trustworthiness with credentials.

The broader context here matters. Enterprise security teams have spent years tightening their perimeters while their SaaS sprawl has expanded in the opposite direction. The average large enterprise now operates hundreds of SaaS applications, many carrying OAuth or API-key integrations into critical systems like Salesforce. Auditing those integrations — knowing which third-party apps hold live tokens, what permissions those tokens carry, and whether revocation policies exist — remains genuinely difficult at scale. Individual teams typically provision integrations without centralised visibility across the organisation.

What Comes Next

LastPass has stated it is working with Klue and conducting its own investigation, though it has not yet published a full incident timeline, detailed scope of affected records, or confirmation that Salesforce access has been fully revoked and re-secured.

For security practitioners, the immediate actions are clear: audit active OAuth grants into Salesforce and similar systems, enforce token rotation policies, and verify that third-party integrations use least-privilege scoping — meaning each tool gets only the minimum access it needs. The harder problem is detection. OAuth token misuse, especially when the token was legitimately issued to a vendor, can look identical to normal application traffic without fine-grained anomaly detection on Salesforce event logs or equivalent audit trails.

LastPass customers, particularly enterprise accounts, should expect further disclosure as the investigation continues. Whether that disclosure arrives promptly and with sufficient detail is, given the company's mixed record on incident transparency in 2022, a fair question.