The supply-chain attack at Klue exposed LastPass CRM and support data, but not its password vaults. According to CrowdStrike’s independent investigation, an attacker used a compromised GitHub token to inject code into Klue’s integration service and collect OAuth tokens, including tokens for Salesforce.
LastPass says its vaults, products, and infrastructure were not affected. The confirmed scope includes contact, support, and sales data in Salesforce; the specific contents of support cases have not been publicly detailed.
Incident timeline and scope
According to Klue’s July 1, 2026 investigation summary, the compromised GitHub token was used on June 11 to introduce unauthorized code and collect integration OAuth tokens. Salesforce alerted Klue to suspicious activity on June 12. LastPass confirmed on June 22 that data in its Salesforce environment was accessed.
CrowdStrike did not determine how the initial GitHub token was compromised and found no evidence of attacker activity in Klue’s environment after June 12. LastPass also says there is no evidence of access to Gong-related data. To inventory critical providers and dependencies, see our NIS2 guide for small businesses.
OAuth is a relationship of trust to review
OAuth often avoids sharing a password between two services. That is useful, but the token given to the application becomes an authorization that can be used. Its security therefore also depends on the supplier that stores it, its rotation process, and the scope of the permissions granted.
In the Klue case, the token did not open a password vault. It provided access to what the integration could reach in connected business tools. For an SMB, that distinction leads to better questions: which data is accessible, from which account, for how long, and with what audit trail?
Practical lessons for a small team
- Inventory applications connected to CRMs, support tools, email, and file storage.
- Remove unused integrations and reduce permissions to what is strictly necessary.
- Plan token revocation and rotation, with a procedure known before an incident.
- Monitor unusual connections and large data exports.
- Do not put critical secrets in shared documents or multiple uncontrolled copies.
For teams administering Salesforce, Datadog Security Labs recommends reviewing events tied to the “Klue Battlecards” application, OAuth refresh-token usage, and unusual API query volumes. These are incident-specific hunting leads, not universal indicators, and should be interpreted in the context of the organization’s logs.
An integration is not just a feature: it is another access path. Reviews should focus on the data that can actually be reached, not only on the service considered primary.
For team passwords, our guide to sharing access with controlled permissions explains how to limit manual copies and define who is authorised.
How Soclyde relates to this incident
This incident does not mean a local vault eliminates third-party supplier risk. Soclyde helps teams keep unique credentials in a local encrypted vault and share only the access they need. It does not protect a compromised SaaS integration, but it can reduce password reuse and manual copies.
Key takeaways
A supply-chain attack can bypass an organization’s visible boundaries: the attacker does not necessarily break the service being watched, but exploits trust granted to a connected supplier.
For an SMB, the response combines regular integration mapping, least-privilege permissions, rapid revocation, and unique credentials kept in an environment under control. Talk to Soclyde about your password strategy.
