LastPass Says Customer Data Was Stolen in Hack at Partner Klue

LastPass has begun notifying customers that their names, phone numbers, email addresses and physical addresses were stolen in a breach at market research firm Klue. @techcrunch reported that the company said the incident occurred on Klue’s systems and did not affect LastPass infrastructure or customer password vaults.

The stolen material also included customer support case data and sales-related records.

Klue identified the unauthorized access on June 12, according to a blog post by its chief executive Jason Smith. Hacking group Icarus claimed responsibility and threatened to publish the data unless a ransom is paid. LastPass has more than 33 million users and about 1.6 million paying customers.

The company previously suffered a 2022 breach in which encrypted password vaults were taken and later linked to several cryptocurrency thefts. Other firms that reported data exposure from the Klue incident include HackerOne, Recorded Future and Tanium. Smith has not responded to requests for further details on the scope of the Klue breach or contacts with the group claiming responsibility.