The LastPass data breach was an incident in which an unauthorized party reached some elements of customer information, using data taken in the earlier August 2022 breach, when source code and technical information were taken. LastPass and its affiliated company GoTo reported it, and LastPass said its Zero-Knowledge design keeps customer passwords encrypted and that no customer action was needed at the time.
What happened in the LastPass data breach?
LastPass, a popular password management service, suffered a data breach that resulted in threat actors gaining unauthorized access to a certain number of customer information.
How is the breach linked to the August 2022 incident?
The data breach targeting LastPass and its affiliated company, GoTo, is known to have been carried out using information obtained in the August 2022 security breach. There are no details about the breach, but the statement made by LastPass officials stated that the unauthorized parties only gained access to some aspects of the customers with the said data breach attempt.
What happened in the first LastPass breach, in August 2022?
In August 2022 an unauthorized party reached the LastPass development environment and took portions of source code and some proprietary technical information. In its notice, LastPass said the attacker used a developer’s compromised endpoint and, once the developer had signed in with multi-factor authentication, impersonated that developer. LastPass said it found no evidence that customer data or encrypted password vaults were accessed in that incident, and that it has no access to customers’ master passwords. Basic steps such as strong, unique credentials and multi-factor authentication on all accounts remain the recommended defenses.
What did LastPass say customers should do?
LastPass has launched a comprehensive investigation into the breach with law enforcement. LastPass reported that its Zero-Knowledge architecture securely encrypts and stores customers’ passwords and that LastPass products and services continue to be available. At the time of that statement, LastPass said customers did not need to act. A later update, on 27 December 2022, reported that attackers had also copied customer data from a backup, including password vaults, which remain encrypted.