194 pointsby mooreds4 hours ago17 comments
  • felooboolooomba5 minutes ago
    Any detailed info on why Klue had this data, apart from being their partner? How does it serve LastPass customers to give that data to Klue?
    • saghm3 minutes ago
      Alternate revenue source to keep them in business as they probably hemorrhage customers due to being maybe the least secure password manager ever? I have to wonder how they have any customers left at all at this point
  • jagged-chisel2 hours ago
    How does anyone seriously trust LastPass anymore? Years ago, I was working for a company handling bank data. They were using LP immediately following a previous LP security incident and had no plans to migrate away.
    • zulban2 hours ago
      A lot of people and orgs don't use security products for security. They use them for security theater. A vast majority of people, even many security people, will never hear about this breach. So LastPass still works great for them.
      • jasonge0_02 minutes ago
        Also use them as a password manager like an advanced version of Excel that fills in the passwords for you. Security isn't part of it. I have the feeling LastPass agrees.
      • bkoan hour ago
        I think a lot of people use products like LastPass because it makes storing passwords easier. Works on mobile, computer, tablet. Pretty good experience tbh.

        With something like LastPass it's also much easier to create unique strong passwords for other sites.

        Also, let's be real:

        > The information accessed was limited to standard business contact information and related customer relationship management (CRM) data, including customer names, phone numbers, email addresses, and physical addresses, as well as support case data and sales-related data.

        I'm pretty sure 99% of the people on exposed have already had their names, phone numbers, email and physical addresses leaked already. This has nothing to do with the security of your passwords stored in LP. They have some CRM, some person from their 800 employees clicked a sketchy link and it leaked that. It's not good, but its hardly an indictment of their product or usefulness

        • antiframe18 minutes ago
          > I'm pretty sure 99% of the people on exposed have already had their names, phone numbers, email and physical addresses leaked already. This has nothing to do with the security of your passwords stored in LP. They have some CRM, some person from their 800 employees clicked a sketchy link and it leaked that. It's not good, but its hardly an indictment of their product or usefulness

          Would you be okay will a public database of all people's names, emails, addresses, phone numbers, and other contact details? After all, most people's data have already been leaked somewhere. Credit reporting agencies have leaked more sensitive data. I, for one, still expect companies to keep my private data private. Especially companies who's started purpose is to keep my secrets secret. It's a bad look for them and if I trusted them this would make me lose my trust in them. But, they already lost my trust two or three (I lost count) breeches ago.

          • vitally36439 minutes ago
            Of course it's not okay. But this is pissing in the ocean. This is throwing buckets of water on the Titanic.

            The damage is already done. Your private information was already leaked long ago. You can't make a sunk boat more wet.

          • stingraycharles8 minutes ago
            Where I’m from there actually were guides like this of the whole country, published once a year, I think even into the early 2000s. They stopped doing it for cost savings, but this type of information being public is considered fairly normal by many, as long as you have the ability to unsubscribe.
          • briffle7 minutes ago
            Only if we also add Social Security numbers, since it was supposed to be a unique Identitifier (like an email) and not a secret.
          • philote12 minutes ago
            Yes, a public database like this would be acceptable. That way the info isn't paywalled behind some white pages site or similar. And then maybe I could even update my own info to be correct. Contact info is pretty much out there for most people already. Hell, I put it on my resume and send that out to many people and put it on public sites.
        • brendoelfrendo19 minutes ago
          > I think a lot of people use products like LastPass because it makes storing passwords easier. Works on mobile, computer, tablet. Pretty good experience tbh.

          Yeah but wanting a product like LastPass doesn't require that you use LastPass. There are many good alternatives.

      • ivanmontillaman hour ago
        This.

        If you want to be a security vendor reseller, just make sure to sell to orgs that have a compliance requirement, either by law or similar.

        Do you sell firewalls? sell them to banks or something. Anti-malware endpoints? Insurances too. SIEMs? payment gateways for their PCI DSS environments.

        Price it just below what would be the fine for not complying, that way you maximize the invoice.

        I stopped playing the security vendor reseller game because it got too boring this way to make money.

      • stymaar2 hours ago
        And it will continue until we can sue company being breached for criminal negligence. Should a single company executive be personally liable in these situations, the scale of the problem would be orders of magnitude less severe because they would spend the appropriate amount of effort to cover their damn ass.
        • jordanban hour ago
          This is it. These companies don't really care about their customer's data. Their SDLC is no more rigorous than any other SaaS product. They have junior people and (now) AI pushing code with a quick "LGTM" PR check just like everyone else.

          The way to stop this is to have actual consequences for the decision makers here. You can build high-integrity software and some fields (avionics) have done it. But the organization needs to be built from the ground up to do it and nobody's going to do it if you can just get breached and offer a phony apology over and over again.

          • Forgeties79an hour ago
            “Here’s a year of credit monitoring. Be grateful.”
      • TimXare43 minutes ago
        At some companies, "approved security vendor" just means the breach comes with procurement paperwork.
      • toomuchtodo27 minutes ago
        It is inertia. People are sticky, they do not switch unless they have to. If you're an enterprise, you have to go through establishing a new vendor relationship, onboarding a new password vault with your IT team, communicate it across the org, migrate data from the old password vault to the new password vault, etc. There is a real cost in time and resources to do this, and so, many avoid it until they have no other choice.

        Lastpass is owned by PE. Why? Because Francisco Partners and Elliott Management bought a cashflow that is sticky. Its why most software companies were acquired by PE prior to the Cambrian explosion of generative AI.

        (Elliott Management is also an activist investor in Southwest Airlines who has ruined that business, so I hope they take the L here)

      • close042 hours ago
        Moving to another solution involves some expense and operational risk (changing procedures, increased human error rates, locking yourself out). Even though the risk of staying with the existing solution goes from "unlikely" to "possible" (so maybe from yellow/amber to red), a lot of companies rationalize it as "but now the provider will be extra careful so the likelihood is actually lower".

        Crowdstrike had a famous incident and is still probably #2 in the cybersecurity world. Sometimes assessing risk is a funny business.

        • seb1204an hour ago
          True, but how come such risks are addressable when adding AI or opening up to yet another API or when some savings are promised with a new product/product feature?
          • close04an hour ago
            > when adding AI ... or when some savings are promised

            Because savings are promised. And who could say no to AI? (/s)

            There's always some risk mitigation possible but it's costly or inconvenient. Companies pretend the risk is lower so they can do whatever they wanted to do but now with less accountability. The risk matrix says so.

            But sometimes the tradeoff is genuinely not worth it. The bottom line is that each company has to do it's own calculations and decide whether moving is overall a better choice. Which risk is higher, that your provider is breached again or that you have new operational issues with the new solution. Which costs more, a chance of another security issue, or the guaranteed expense of replacing the solution? You do the same math at home all the time. Your washing machine leaked once, do you replace everything or just patch the hole?

    • sys_6473814 minutes ago
      I remember ten years ago telling our so-called leaders that the data will get leaked from LastPass. They were all gung-ho about it being secure blah de blah. Luckily most of us don't work there anymore.
    • pluc17 minutes ago
      People still use Windows
    • dwoosleyan hour ago
      I’ve done a lot of security consulting work for hundreds of companies and one thing I noticed is that the companies that actually took security seriously were the ones that had been breached in the past. Until the execs and board see the dollar impact themself and not just read about it, the security program never gets the funds it needs.

      I’m not saying I recommend LastPass for that reason, but I wouldn’t write them off for that reason.

      • gonzalohman hour ago
        But LastPass has been breached multiple times by now. I don't think they really care
        • dwoosley43 minutes ago
          There are lots of types of a “breach”. The first and second (the major ones) were likely related so more like one continuous incident. This one was a vendor breach that had access to their data so not a reflection of their security program as much as the first.

          I’m not saying you’re wrong, I’m saying you can’t tell from this incident.

      • sys_6473810 minutes ago
        What happened to the old days of only getting one chance to f-up? Once chance and they should be gone permanently.
    • fidotron2 hours ago
      The one that amazes me is Okta.

      OK their Mac UX is great, but given their rate of incidents how can you trust it?

      Clearly this stuff is not actually bought based on track record.

      • jordanban hour ago
        Funny I used to work in an org with Okta.

        Having your own auth workflow was instant fail with the well architected framework committee. Using Okta was instant pass.

        I don't necessarily disagree with that policy but given that Okta was breached several times while I was working there, it was interesting the extent to which our CSO had blinders about it.

        • eddieroger21 minutes ago
          Liability is the answer! If you build an auth system and it fails, it's your backside. If Okta fails, it's theirs. Enterprises buy products as much as they buy protection from problems.
      • lowdudean hour ago
        As someone that is not really in the game, does Okta have such a bad track record, and are there alternatives that are considered solid? From the outside, it seemed like EntraID is a bit of a burning dumpster fire, while Okta seemed expensive, but usable and decent (from comments I read)
        • mrhottakesan hour ago
          The current default for lazy enterprise customers seems to be an unholy tangle of Active Directory, Entra, and Okta. If you use all three it's 3x more secure, right?
          • Avicebronan hour ago
            Okta I get, Entra I sort of get. But AD is great.
    • hosteur42 minutes ago
      How does anyone trust ANY third party with all their passwords and encryption keys is beyond me.

      Setting up KeePassXC is trivial.

      • kirici8 minutes ago
        Passbolt and Bitwarden can be self-hosted on top of offering the usuals pros like MFA, an API incl. integrations (e.g. https://external-secrets.io/latest/provider/passbolt/) and a better UX that does not involve syncing files between team members
      • xtracto35 minutes ago
        This. KeePassXC plus Google Drive client is all you need.
    • farfatched2 hours ago
      What's the risk, and does that change by moving to an alternative?

      Companies deal with leaked secrets a lot. A company already using a password manager is ahead of the game.

      Suppose they move to a competitor. That's a migration and training that someone has to drive. What do they gain? Another company that can also have exploits? Or they self-host, and now have to fund that, and still potentially get exploits?

      Ultimately, this likely isn't that big of a deal for a company.

      And they have to weigh it up against all the other things that they can be doing.

    • DANmodean hour ago
      > They were using LP immediately following a previous LP security incident

      “Yeah, but they fixed that!”

      Normies don’t pull the historical list of breaches and vulns.

      They just read headlines.

  • khurs2 hours ago
    Lots more companies affected. Some more listed below:

    >"Klue has not said how many of its hundreds of customers are affected. Several companies have come forward to confirm they had data stolen during the attack, including Gong, Jamf, HackerOne, Insurity, OneTrust, Recorded Future, Snyk, Sprout Social, and Tanium."

    >Cybercrime group Icarus took credit for the breach, saying on its leak site that it will publish the stolen data on Monday if the company does not pay the hackers’ ransom."

    https://techcrunch.com/2026/06/22/klue-hack-results-in-data-...

    • Cider99863 minutes ago
      I appreciate ransomware groups more than the ones that will sell privately because at least everyone gets the data.
  • fusslo2 hours ago
    I'm sure this is worse than using lastpass in some way

    but for the past couple years I've just generated and forgotten 90% of my passwords. the final 10% I keep in a password manager. But if the service isn't really that important I just use the 'forgot my password' to change and generate a new password every time I need to login

    • stanac2 hours ago
      This works if the account doesn't have 2FA. On my last side project app users can login only via email OTP. There are security downsides with that, someone can send phishing link and use OTP submitted to the fake site, but the app doesn't store anything sensitive (it's a game which tracks your progress) so I guess it's not a major security risk.
    • seb1204an hour ago
      I got caught out as I had no longer access to the old phone number that was now used to send 2FA text.
      • fussloan hour ago
        oh dang that's not good. I've had the same phone number since 2006 so I didn't really think about it
        • antiframe9 minutes ago
          But the phone number you have is not 100% in your control. I had AT&T flub something and I lost my number and they assigned me a new one (I was chanting my plan just after they did some merging with someone). Granted its unlikely but I would still use defense in depth and not have password reset be my only login method.
  • variety86752 hours ago
    https://blog.lastpass.com/posts/klue-supply-chain-incident-a...

    > The information accessed was limited to standard business contact information and related customer relationship management (CRM) data, including customer names, phone numbers, email addresses, and physical addresses, as well as support case data and sales-related data.

  • john_strinlaian hour ago
    any company that stuck around (or began using) lastpass after vaults were leaked probably does not care about this one at all, considering its just CRM data.

    i can sympathize a little bit with companies that stick with lastpass. when i had to switch an org from lastpass to 1password, it was a massive undertaking and incredibly annoying. however, i have no sympathy for anyone who has chosen lastpass after 2022.

  • username1352 hours ago
    I switched to keepass a decade ago (maybe) and never looked back
  • insanitybit2 hours ago
    This isn't great but it's not that big of a deal either. A lot of companies got bit by the Klue breach but it's not like your vaults are being accessed.
    • mrhottakesan hour ago
      The vaults were accessed years ago
      • master-lincoln42 minutes ago
        The encrypted vaults, yes. Ideally they are worthless when the master password is sufficiently complex
      • insanitybit21 minutes ago
        Yes, in a separate breach.
  • chinathrow2 hours ago
    Sitting here with my KeepassX and being happy, again.
    • shizcakes2 hours ago
      For folks new to the KeePass ecosystem, it’s KeePassXC[0] now. The original KeePass is still developed as well, however KeePassXC is a cross-platform updated version.

      [0] https://keepassxc.org/

      • panick21_an hour ago
        How good is their mobile and sync story?
        • doubled112an hour ago
          Syncing isn't a KeePassXC problem. The database is just a file. That may or may not make your life easier.

          There are a few decent Android and iOS apps that work well. I use Nextcloud and WebDAV for access.

          Not a setup I can recommend to just anybody though.

          • shizcakesan hour ago
            One of the security advantages of KeePass being just a file is that you can sync it in the way that makes sense to you.

            The need to have an opinion on how you’d like to sync a file does, as you suggest, eliminate some portion of the population who need a fully baked answer in one step.

            I used to use Google Drive, but now I use Syncthing, further reducing my exposure. Paired with Synctrain and KeePassium on iOS.

            One tip: enable the atomic save option in settings to reduce the risk of weird cloud sync issues.

            • antiframe5 minutes ago
              And if you use an untrusted sync like Google Drive, you can enable a keyfile and never let that file lane on Google Drive.
        • nickjjan hour ago
          The mobile app is quite good, it works and gets out of your way. I use it on Android.

          For syncing, I do it manually with rsync. Given the database is 1 file it's easy to move around. You can rsync / scp it over, use a USB cable, use cloud storage, etc..

          I use a password manager in a "read many, write infrequently" way so I don't mind occasionally syncing it as needed.

        • cryo32an hour ago
          I use keepassxc. I don’t sync mobile. My mobile device has an only the minimum subset of passwords I need saved on it.
  • khurs2 hours ago
    >an incident that occurred at Klue (klue.com), a third-party market intelligence platform

    Well, I hope Klue got them more customers than they are losing due to this.

  • TZubiri2 hours ago
    Using a password manager has 2 main tradeoffs and mistakes:

    1- Tradeoff individual account risk, for systemic risk. You may argue password managers are safe, but few would argue that the risk model reduces the risk of individual password leaks more than the risk of all your passwords leaking. It's a tradeoff.

    2- Cat and mouse security: There's a class of security decisions that work because they are new and different. First the weakness was that passwords were short, then you make passwords long but unmemorable, so people rely on some other mechanisms to authenticate, like a file on their computer, a drive, a fingerprint, facial recog, which may in turn be protected by a second factor password.

    At first the new security model will not be stressed, but as more users migrate from one security model to the next one, that's when you are able to compare the security of both technologies, it starts being a juicy enough target that it becomes attacked.

    So we are at the point where password managers are used enough that they start becoming worthwhile targets of attack (to overcome the difficulty of vulnerating them).

    Also worth noting that these attacks are more winner-takes-all. In the sense that rather than seeing one account hacked every couple of hours, you will see them all hacked at once, because you introduced a vendor in the password supply chain AND because the vendor centralizes all of the passwords. So target that one vendor and from a single attack you get all the spoils. So when comparing the security of the olden method and the new, just 1 incident is enough to undo all of the reputational gains it has made over the years.

    • amenghra2 hours ago
      Password managers (whether it's Lastpass or your browser's built-in password store) also protect against phishing since they tie passwords to domain names.

      I don't think password managers which store encrypted vaults are less safe than trying to have and juggle strong unique-per-domain passwords, even if you think that the password manager is becoming a target.

      • al_borland2 hours ago
        When they work… I finally gave up on 1Password as it has been getting worse and worse about actually autofilling for a few years. After all the Avengers turned into investors and the price increase was announced, I jumped ship. It felt like they were more worried about their ROI than the product. After 18 years of use, this was pretty disappointing.
        • amenghra34 minutes ago
          For personal use, Bitwarden + a Raspberry PI should work perfectly fine. Your devices will sync when you are home. If they get out of sync, your fallback is to password reset. Or use your browser's built-in password manager which also syncs in most cases. I prefer to be browser-agnostic since it gives an easy solution to handle non-web passwords.
    • zarzavat2 hours ago
      "Password manager" used to mean a program that runs locally on your computer. At some point people started making it into a SaaS, because that's more profitable.

      I do think there are some cases where an online password manager makes sense, e.g. for businesses, but for individuals it's better to just stick with an offline password manager, at least for the high value accounts.

      • pdimitar2 hours ago
        You can and should have the best of both worlds. Using Enpass, the program _is_ local, it just backs up the entire database (encrypted SQLite3) to a cloud.

        But if even that is too much then f.ex. `keepass` + a scheduled script to periodically backup to your own servers is also perfectly viable.

      • NoMoreNicksLeftan hour ago
        >At some point people started making it into a SaaS, because

        Wait. That's a thing? Like, there are drooling, mouth-breathing stooges out there that would trust not just one of their passwords to such a thing, but all their passwords to it?

      • panick21_an hour ago
        It became SaaS because its more practical when you have many devices or many users.
    • acheron2 hours ago
      The article is about a marketing data breach, not passwords.
      • al_borland2 hours ago
        From a marketing perspective, a data breach of any kind looks horrible for a company whose entire job is keeping secrets safe.
      • TZubiri22 minutes ago
        I understand, just making a general comment.

        And it's not unheard of that infections metastize, whether into developer accounts, product code... Probabilistically, this was a shot on goal.

        I apologize for the mixed metaphors.

    • rpdillon2 hours ago
      > The information accessed was limited to standard business contact information and related customer relationship management (CRM) data, including customer names, phone numbers, email addresses, and physical addresses, as well as support case data and sales-related data.
    • kijinan hour ago
      It's not just about long vs. short passwords. IMO the greatest benefit of having a password manager -- whether it's a bloated Electron app or just a text file on your computer -- is that it enables you to juggle hundreds of different passwords, randomly generated for each site. It's the best way we know of to limit the blast radius when (not if!) some of those sites inevitably get hacked.
  • lyu072822 hours ago
    • TZubiri2 hours ago
      >“On June 12th, LastPass was made aware of an incident that occurred at Klue (klue.com), a third-party market intelligence platform utilized by our go-to-market teams, which integrates with our Salesforce and Gong systems,”

      The specific dependency that gets companies infected, and the optics that result, are so important. There have been sillier examples, but you can see how in this case, the priority of sales and profits has resulted in the sacrifice of the main quality measure of their main and only product.

      • psandor2 hours ago
        “ the priority of sales and profits has resulted in the sacrifice of the main quality measure of their main and only product”

        What do you mean exactly here What do you think LastPass could have done to prevent this specific issue?

        • khurs2 hours ago
          Did they need to give them all of this?

          customer names, phone numbers, email addresses, physical addresses, support case data, sales-related data.

        • lyu072822 hours ago
          Bitwarden doesn't redirect you to a third party if you visit their support page:

          https://bitwarden.com/help/

          But LastPass does (Salesforce CNAME):

          https://support.lastpass.com/s/?language=en_US

          So this couldn't have happened to bitwarden, you own the reputation loss if any of your suppliers get owned. Though it really doesn't matter anymore for LastPass they leaked their customers vaults before, I have no idea how they can still be in business.

        • TZubiri25 minutes ago
          Not installing the infected package of course.

          It's worth noting that this is not 'their marketing provider' what they do is load 30 different providers for some reason, to maximize the reach of their data sharing and advertising network. Well, their network reached too far and touched an infected node.

        • pasc1878an hour ago
          Not supply the information to any other company.
      • fn-mote2 hours ago
        > the priority of sales and profits has resulted in the sacrifice of the main quality measure of their […] product

        To be fair, and I don’t want to, supposedly the only thing that was compromised was contact info. No vaults were exfiltrated or unlocked (as far as the article info goes).

        So this is really just another very boring info breach, not a targeted password-stealing hack.

        The other breaches they suffered were worse.

  • jrm425 minutes ago
    Lol. Again.

    Private company third party password managers are bad. Across the board. They're a bad idea.

    Deeply localized actual best practices can help solve this. Private companies can also help, but only if it isn't in the form of "you can't have this unless you pay for it." The point is, it's like fighting fires, you can't isolate it.

    It's a complete dead-end and the sooner the industry realizes this the better.

  • throwawayffffas2 hours ago
    So... you business plan is to secure peoples personal data by handing some of that data to a third party. Got it.
    • cyanydeez2 hours ago
      the Achilles heel of a "secrets vault" is it becomes a defacto priority target. I still dont see how any reasonable person was convinced a cloud service was the best place to put all their secrets.
      • throwawayffffas2 hours ago
        The problem is not the secrets vault. It's the casual acceptance of giving peoples data to third party processors. What value do last pass customers get from having their details passed on to a marketing firm? None. For all the talk of privacy and putting customers first they are acting like any other company in any other field.
      • tlb2 hours ago
        Gmail is at least as large a target, and they don’t keep having breaches.
  • paulbjensenan hour ago
    Once more onto the breach…
  • greenavocado4 minutes ago
    This is why I use Microsoft Teams and Outlook as my password manager. I just save my passwords to draft or email them to my coworkers so they never lose track /s