LastPass notifies customers that their personal information and customer support case records were stolen during a hack at Canadian market research company Klue (Zack Whittaker/TechCrunch)

LastPass disclosed that customer personal information and support case records were compromised through a breach at third-party vendor Klue, a Canadian market research firm, expanding the attack surface beyond LastPass's own infrastructure. This incident underscores the critical supply chain and third-party risk management challenge facing IT organizations, as even security-focused vendors rely on external partners whose vulnerabilities can expose sensitive customer data. For CIOs, this breach reinforces the need for rigorous vendor security assessments, continuous monitoring of third-party access, and incident response planning that accounts for cascading risks across the technology ecosystem.