LastPass breach #3 leaked no vaults: it spilled through a CRM vendor, Klue
The passwords were safe. What leaked were customer names, phone numbers, and physical addresses, sitting inside a market-intelligence tool LastPass had wired into its sales stack — and the same hack hit Snyk, HackerOne, Jamf, and Tanium too.
LastPass's third breach notice didn't come from its own servers. A vendor called Klue — a CRM-attached "market intelligence" platform for sales teams — got compromised, exposing LastPass customer names, phone numbers, emails, and physical addresses. Encrypted vaults were untouched.
On HN the pile-on was instant. But the sharpest comment cut the other way: a security engineer noted every sales org has a dozen of these tools wired in, and the only surprise is that this kind of breach doesn't happen far more often.
A breach notice that never reached the password vaults
LastPass sent users a breach notification on June 23, 2026, its third such notice, and this one originated nowhere near its own infrastructure. The leak came through Klue (klue.com), a market-intelligence platform that plugs into CRM stacks like Salesforce and Gong. Attackers compromised Klue, and LastPass customer records stored there came out with it.
What actually leaked, per LastPass's own incident post, was standard business contact and CRM data: customer names, phone numbers, email addresses, physical addresses, plus support-case and sales data. The encrypted password vaults, the thing that makes a password manager a juicy target, were not touched. LastPass says it revoked employee access to Klue, rotated exposed API tokens, notified law enforcement, and flagged three suspicious IP addresses and three sender domains tied to the attackers. The advice to users: watch for phishing and social-engineering attempts built from the leaked contact details.
LastPass wasn't alone in the blast radius. The Klue compromise pulled in records from a long list of its customers.
"Klue has not said how many of its hundreds of customers are affected. Several companies have come forward to confirm they had data stolen during the attack, including Gong, Jamf, HackerOne, Insurity, OneTrust, Recorded Future, Snyk, Sprout Social, and Tanium." — a reader who surfaced the TechCrunch report
The same reader noted the extortion angle: a cybercrime group calling itself Icarus took credit, threatening to publish the stolen data if a ransom went unpaid.
The thread's reflex, and the engineer who broke it
The 479-point thread opened the way every LastPass thread opens now: links to the two previous breach discussions and a dry "third time's the charm." Then the migration stories rolled in. KeePass, Bitwarden, Enpass, pass, Apple Passwords: each a small monument to a vault someone had already abandoned.
The hardest line on staying belonged to a recurring HN sentiment about the 2022 vault leak:
"i have no sympathy for anyone who has chosen lastpass after 2022." — a commenter who'd run a LastPass-to-1Password org migration
He added the part the migration evangelists skip: moving an organization off LastPass was "a massive undertaking and incredibly annoying," which is exactly why companies stay.
But the comment that actually reframed the story came from someone who'd clearly sat inside a sales org's tooling sprawl:
"Klue is one of those CRM services that so many sales teams are using. Yes, you have to hand them customer records… If you go to your sales teams and see what random stuff they have hooked up to your systems, I bet you will find similar things… I am more surprised that these breaches don't happen more often." — an engineer describing how sales orgs wire up third-party tools
The point lands: this wasn't LastPass being uniquely reckless with vaults. It was the ordinary, invisible supply chain every B2B company runs, and any one node in it can spill the customer list.
A security engineer whose bio traces a Rapid7 → Dropbox → Datadog path agreed on severity, against the thread's mood:
"This isn't great but it's not that big of a deal either. A lot of companies got bit by the Klue breach but it's not like your vaults are being accessed." — an infosec engineer
The leak that should have been impossible
The genuinely awkward question wasn't whether vaults were safe. It was why this data existed at Klue at all. One commenter put the obvious version bluntly:
"WTF is LastPass doing, handing customer details to a market research company? Any such data should have been fully anonymized: no names, no specific addresses, etc." — a KeePassXC user who sees no reason to ship raw customer records to a vendor
That is the asterisk on every "your vaults are fine" reassurance. A password company's whole pitch is that it can be trusted to centralize your most sensitive data, yet the third notice in three years is a reminder that the data it centralizes leaks through the boring back door, the sales CRM, not the front. For a LastPass user the practical takeaway is small and specific: no password to rotate, but your name and address are now phishing fuel, and the sender domains LastPass flagged are worth not clicking.
Get breakdowns like this every day
The top Hacker News stories, unpacked — by email, Telegram, or RSS.
OpenAI's own advisers are telling Altman to delay the IPO until 2027
The reason they gave is the tell: wait, they said, because SpaceX's stock has been volatile and OpenAI is grappling with financial challenges. The thread read that sentence as a confession.