LastPass Hit Again After Hackers Breach Tech Partner Klue

Hackers just found another way into LastPass data. The password manager company is busy alerting users that attackers stole customer support records and personal details during a recent cyberattack. The twist here is that the breach did not happen on LastPass systems. Instead, the attackers broke into a market research firm named Klue, which LastPass relies on for business operations.

As you can see in the TechCrunch layout featured in image_beed14.jpg, this event marks yet another security headache for the company. LastPass sent out emails to affected users to explain the situation. According to those alerts, the hackers exploited their access at Klue to pull massive amounts of data about LastPass users. They managed to grab names, phone numbers, email addresses, physical addresses, sales records, and customer support history.

LastPass wants everyone to know that its own internal networks and servers remain safe. The hackers did not get into the main infrastructure, and they did not access user password vaults during this specific event. While that sounds like good news, the stolen support tickets still carry real danger. LastPass does not know exactly what each customer wrote in those tickets, but support logs usually contain highly sensitive info. People often message support when they have trouble logging in or face billing issues. In previous security incidents with other companies, support tickets exposed login credentials and government identification papers.

This third-party attack is part of a much bigger trend. LastPass is just one name on a growing list of tech businesses hit by the Klue hack. Other major cybersecurity firms like HackerOne, Recorded Future, and Tanium also confirmed that attackers compromised their data through this same partner. The group taking credit for the mess is a hacking and extortion gang known as Icarus. Klue Chief Executive Officer Jason Smith stated that the intruders are threatening to leak all the stolen files unless the company pays a ransom fee.

This issue is especially sensitive because LastPass has a bad track record with security. Back in 2022, hackers managed to steal the company’s entire backup of encrypted user password vaults. Those vaults held master passwords, tokens, and financial data. Even though the vaults were encrypted, the 2022 breach allowed criminals to take the files offline and run brute-force attacks to crack weak master passwords. Some users lost major cryptocurrency funds later because hackers cracked their vaults.

Right now, LastPass serves over 33 million users and about 1.6 million paying businesses. The company has not yet shared exactly how many of those accounts are caught up in this new partner breach. This latest incident reminds everyone that your data is only as secure as the weakest vendor a company hires. Even if a business locks down its own app, a single compromised partner can expose your personal life to the dark web.