Skip to Main Content
PCMag editors select and review products independently. If you buy through affiliate links, we may earn commissions, which help support our testing.

LastPass Breached Once Again, Hackers Gain Access to Sensitive Customer Data

Though the breach occurred at a third-party service provider, hackers used that access to steal LastPass customers' contact info and physical addresses.

June 24, 2026
LastPass app logo displayed on a smartphone (Credit: Mateusz Slodkowski/SOPA Images/LightRocket via Getty Images)

Getting your Trinity Audio player ready...

Password management app LastPass has confirmed that sensitive customer data was stolen in a new security incident.

Exposed data includes customers' names, phone numbers, physical addresses, and email addresses. According to LastPass, the breach originated at Klue, a third-party market intelligence service it has integrated with its own systems. Hackers obtained LastPass OAuth tokens held by Klue and used them to access customer data.

The password manager says it became aware of the incident on June 12 and has since blocked the unauthorized access. “LastPass products, services, and infrastructure were not impacted in any way, and customer vaults remain secure,” it adds.

The latest lapse isn’t as severe as the company’s 2022 breach, in which a hacker obtained copies of customers’ encrypted passwords. LastPass agreed to settle a lawsuit related to that incident by paying $24.5 million to affected customers earlier this year, and anyone who used the app before November 2022 is eligible to file a claim before July 2, 2026.

Following its latest leak, LastPass has asked customers to remain vigilant for possible phishing attempts. "Always exercise caution regarding unsolicited communications, including emails, phone calls, or requests for sensitive information," it says. "Please remember that no one at LastPass will ever ask for your master password."

Earlier this month, rival password manager Dashlane revealed that a hacker had launched a brute-force attack against 20 users to register new devices on existing accounts.

About Our Expert