Password manager LastPass disclosed that attackers who breached its systems had copied a backup of customer vault data. The vaults contained encrypted passwords as well as unencrypted information such as website addresses.
What happened
- The incident followed an earlier breach in August 2022, when source code and technical information were stolen from a development environment.
- Attackers used information from that first breach to target an employee and reach cloud storage holding backups.
- LastPass said encrypted fields could only be unlocked with each user’s master password, which it did not store.
- Customers with weak master passwords were warned that their vaults could be vulnerable to guessing attacks.
Why it mattered
The breach damaged trust in a widely used security tool and prompted many users and organisations to rotate large numbers of credentials. LastPass later said the attackers had targeted a senior DevOps engineer by compromising their home computer.
Lessons for organisations
Organisations should protect developer and backup environments as carefully as production, use strong master passwords with MFA, and have a plan for rotating credentials quickly if a password manager is compromised. Securing staff home devices used for privileged access, or preventing their use, closes a common gap.
Sources: LastPass, TechCrunch
Part of our Top stories archive of headline-making events in information security, privacy, and AI. If you would like help applying the lessons to your organisation, contact us.
