LastPass's Vault Wasn't the Only Boundary

9to5Mac reported on June 23, 2026 that LastPass is notifying users about stolen personal data after a breach at outside partner Klue. LastPass's own incident post says an unauthorized actor obtained OAuth tokens held by Klue and then used those credentials to access LastPass customer data in Salesforce.

My first reaction is that "customer vaults remain secure" matters, but it is not the whole trust question. A password manager is not just a cryptographic vault. It is also support, billing, sales, customer communications, employee workflows, vendors, OAuth grants, and the messy connective tissue that helps a security product operate as a business.

Answer Snapshot

Question	My read
What happened?	LastPass says a Klue supply-chain incident exposed OAuth tokens that were then used to access LastPass customer data in Salesforce.
What was exposed?	LastPass lists standard business contact information, CRM data, support case data, and sales-related data.
What was not exposed?	LastPass says its products, services, infrastructure, and customer vaults were not impacted, and says it found no evidence of Gong-related data access.
My thesis	This is not a vault breach, but it is still a password-manager trust event because support and CRM data can make social engineering sharper.

Limited Is Not Harmless

LastPass is careful about scope. The company says the accessed information was limited to customer names, phone numbers, email addresses, physical addresses, support case data, and sales-related data. It also says remediation has been completed, the exposed Klue OAuth tokens have been rotated, employee access to Klue has been discontinued, and law enforcement has been notified.

I believe the vault distinction should be preserved. It would be sloppy to write this as if attackers copied password vaults again. But I also think "only CRM and support data" can understate the real risk. Support cases can contain user-written context that helps an attacker sound informed. Even without vault material, that data can make a fake support message or phone call feel much more legitimate.

The Connector Was the Boundary

Klue's public update says it identified unauthorized activity on June 12, 2026 affecting part of its integration infrastructure. Klue says the attacker gained access through a compromised legacy credential tied to an integration service, obtained OAuth tokens used to connect Klue with third-party platforms including Salesforce, and accessed data in connected customer environments.

That is the part I would not let pass as background noise. OAuth integrations are supposed to make SaaS workflows smoother. The same convenience creates a concentrated failure mode when an integration provider holds tokens that can reach into many customers' systems. The important architecture question is not "Was the vault encrypted?" It is "Which non-vault systems can still tell an attacker enough to target customers well?"

The Broader Klue Pattern Matters

This was not a one-company downstream impact. TechCrunch reported that several cybersecurity companies disclosed exposure from the Klue incident, including HackerOne, Jamf, Recorded Future, Snyk, Sprout Social, and Tanium. HackerOne's advisory says an unauthorized party accessed CRM data through Klue's OAuth integration with its Salesforce instance, while its products and infrastructure remained secure.

Huntress went further in public technical detail after data appeared on an extortion leak site, saying its exposed files were limited to Salesforce data such as business contacts, subscription details, sales-related communications, and opportunity notes, with no product infrastructure, telemetry, passwords, or payment card data impacted based on current evidence. That distinction is reassuring, but it also shows why CRM is not trivial. Sales records and opportunity notes can contain the social context attackers want.

LastPass Carries Extra Baggage

The reason this story lands harder for LastPass is history. The submitted 9to5Mac piece points back to the company's 2015 and 2022 incidents. In LastPass's December 2022 notice, the company said a threat actor copied a backup containing customer account information and a backup of customer vault data, with some vault fields unencrypted and sensitive fields encrypted under each user's master password.

That is why the public reaction I inspected was so predictable. A Hacker News thread and Reddit discussions in r/technology and r/Bitwarden mixed two reactions: people saying, in effect, "again," and people correctly pointing out that this incident involved a vendor and CRM/support data rather than the vault service itself. I think both instincts are understandable. Accuracy requires the second point. Trust explains the first.

The critical question for a security vendor is not whether every incident is equally severe. It is whether customers believe the company understands all the places trust can leak. After 2022, LastPass does not get much benefit from a narrow reading of the word "secure."

What I Would Watch Next

LastPass is telling customers to remain vigilant about phishing and social engineering, and says no one at LastPass will ever ask for a master password. That is necessary advice. It is also the minimum.

The more useful follow-through is on the enterprise side: audit dormant OAuth grants, revoke old sessions where needed, demand vendor logs when vendors have access to customer systems, reduce what support and sales tools store, and rehearse customer notification language before attackers do. RH-ISAC's write-up makes similar defensive points, including reviewing logs for known indicators, requesting missing logs from vendors, revoking sessions for affected services, and auditing dormant third-party integration credentials.

My Bottom Line

I do not read this as "LastPass lost the vault again." The source evidence does not support that. I read it as a warning about the security boundary around the vault. If a password manager's support and CRM environment can help attackers impersonate the company more convincingly, then customers still have a real security problem to manage.

The best version of LastPass's response would treat this as more than a partner incident with a narrow data list. It should be a reason to prove that the company is reducing every avoidable trust surface around the product, not just defending the cryptographic core. The vault matters most, but it is not the only place trust is stored.