Reported by 1 outlet
Klue Supply Chain Breach Widens — LastPass Confirms Salesforce Data Theft, BeyondTrust Discloses Impact
Why this score
- Breadth
- 0.50 / 2.0 · 1 source
- Authority
- 1.80 / 2.0 · best outlet weight
- Severity
- 0.80 / 5.0 · CVSS + content signals
- Velocity
- 0.00 / 2.0 · updates in 48h
- Pickup speed
- 0.00 / 0.6 · time to second source
- Recency
- × 0.00 temporal multiplier
- Community
- + 0.00 / 1.5 · reddit signal
- Score
- 0.0 / 10 = base × recency + community
Timeline
-
original reporting
Klue Supply Chain Breach Widens — LastPass Confirms Salesforce Data Theft, BeyondTrust Discloses Impact
bleepingcomputer.com · 112d ago · June 24th, 2026
The Icarus extortion group's June 12 compromise of Klue's OAuth integrations continues to ripple through the security vendor ecosystem. LastPass confirmed attackers accessed customer names, phone numbers, email addresses, physical addresses, and support case data from its Salesforce environment using stolen OAuth tokens — but emphasized that customer vaults, products, and infrastructure remain secure.
BeyondTrust also disclosed impact, joining a victim list that now includes HackerOne, Huntress, Jamf, OneTrust, Recorded Future, Snyk, Tanium, Insurity, and Sprout Social. LastPass warned of increased phishing risk using sender domains
baccarat.com[.]au,robinskitchen.com[.]au, andhouse[.]com[.]au. The Icarus group's data leak deadline for negotiations passed June 22 with no published dump reported as of this writing, but affected organizations continue rotating OAuth tokens and auditing Salesforce API logs.Context: Previously tracked June 19–23 (initial disclosure, Klue CEO statement, Huntress confirmed, Salesforce platform-wide disable, Icarus extortion). New today: LastPass and BeyondTrust confirm impact, specific phishing sender domains identified.