LastPass experiences another data breach, but your password vault is secure this time.

      The company has reported that hackers gained access to customer names, contact information, and support records through a third-party vendor rather than through LastPass' own systems.

      If you've ever sent a support ticket to LastPass, that information may now be accessible to hackers. As reported by TechCrunch, LastPass has confirmed that a recent breach at one of its third-party vendors led to the exposure of customer names, contact information, and support case records.

      What the hackers accessed and what remained secure

      According to LastPass, its internal systems were not breached, and users’ password vaults continue to be secure. The compromised data was accessed through Klue, a market research firm that LastPass collaborates with.

      LastPass

      While no passwords were taken, hackers exploited their access to Klue’s network to obtain customer records such as phone numbers, email addresses, physical addresses, and support ticket details.

      In a blog post addressing the incident, the company emphasized that the breach did not impact encrypted password vaults, master passwords, or credentials stored within LastPass. Nonetheless, the released information could still be advantageous to perpetrators, who might use it for phishing or social engineering attacks.

      An outdated credential was the cause

      The exposure of LastPass data is tied to a broader security breach at Klue, where it was found that attackers accessed the systems using a credential from a pilot project established in 2022. TechCrunch indicates that this credential was still active and allowed entry into the company’s systems.

      Klue disclosed that the attackers could access customer data linked to its services, affecting various organizations that depended on the platform. In addition to LastPass, companies such as Gong, Jamf, HackerOne, Insurity, OneTrust, Recorded Future, Snyk, Huntress, Sprout Social, and Tanium were also impacted.

      For LastPass, this is the second instance wherein user data has been involved in a breach. A breach in 2022 compromised encrypted password vaults, later associated with cryptocurrency theft. Although this latest incident did not involve vault data or passwords, it demonstrates how a security failure at a third-party vendor can still have repercussions for customers who never directly interacted with that vendor.