LastPass, a provider of password management services, has informed its users that their personal data and customer support case records have been compromised due to a recent breach at one of its technology partners, marking yet another data security incident for the company.
In communication shared with TechCrunch by a victimized customer, LastPass clarified that the breach occurred at Klue, a market research company, not within its own systems. Nevertheless, hackers exploited this situation to gather extensive data concerning LastPass users.
LastPass joins a number of cybersecurity firms impacted by the Klue breach, which was publicly revealed last week. Other affected entities include HackerOne, Recorded Future, and Tanium.
In a blog post detailing the event, LastPass confirmed that the compromised data includes customers’ names, phone numbers, email addresses, physical addresses, and information from customer support cases, along with sales-related data.
LastPass emphasized that its own systems remained secure, including the password vaults used by customers.
The specific contents of the customer support tickets that were accessed are not yet fully known, though they likely include parts of sensitive information. Customers generally reach out to support for issues related to billing or account access. Previous incidents involving customer support records have revealed personal identifiers and sensitive documents.
LastPass representatives did not respond promptly to inquiries from TechCrunch regarding the breach, including the number of customers potentially affected.
As of 2024, LastPass boasts more than 33 million users and approximately 1.6 million paying customers, according to their official data.
LastPass has faced prior security breaches, notably in 2022 when hackers accessed its complete database of customer password vaults, which store sensitive credentials like passwords and credit card information.
While these vaults are encrypted with master passwords that only users know, the breach allowed hackers to attempt to crack these vaults offline using weak master passwords, leading to possible exposure of critical information. Several instances of cryptocurrency theft were later associated with this breach, as intruders were believed to have accessed victims’ wallet keys through compromised password vaults.
Jason Smith, CEO of Klue, noted in a blog post that the presence of hackers in their systems was identified on June 12. An extortion group known as Icarus has claimed responsibility for the incident and has threatened to release the stolen information unless a ransom is paid.
Smith has not yet responded to inquiries from TechCrunch regarding the breach, including the extent of the impact on customers or whether the company is in discussions with the hackers.
