LastPass hacked, but users’ passwords were not accessed

A hacker has infiltrated the LastPass password manager, but the company’s initial investigation shows that the intrusion only caught the company’s internal systems for software development, not data related to customer passwords.

On Thursday, LastPass emailed customers about the breach, which the company discovered about two weeks ago.

“We have determined that an unauthorized party gained access to portions of the LastPass development environment through a single compromised developer account and took portions of LastPass source code and certain proprietary technical information,” the company said.

“We have no evidence that this incident involves any access to customer data or encrypted password vaults,” the message added.

Message from LastPass

In response, the company implemented “containment and mitigation measures” and hired a leading cybersecurity firm to investigate the intrusion. The company has also posted an FAQ section noting that all LastPass products and services have been operating normally, despite the breach.

LastPass has not provided any other details as the provider embarks on the forensic investigation. But a major concern is whether the stolen proprietary data will pave the way for cybercriminals to discover vulnerabilities in the company’s password management products.

For now, the LastPass Company FAQ notes do not store information about the “Master Password” that customers use to access their accounts through the password management service. Instead, the company relies on a “zero-knowledge” encryption model to unlock access to a user’s account. This involves storing the Master Password only on the customer’s device.

“At this time, we do not recommend any action on behalf of our users or administrators,” adds the company’s FAQ section. But for extra protection, consider enabling multi-factor authentication on your account. LastPass plans to update customers on the investigation as it progresses.

Neil J. Rubenking, PCMag’s principal security analyst, received the email from LastPass, but says he’s not worried. Even if the data accessed had included encrypted password vaults, “the thief would have no way of getting in without the password. And LastPass (like all password managers) never stores your password, just a hash of the password,” he said.

Be the first to comment

Leave a Reply

Your email address will not be published.