LastPass is continuing to investigate this incident and have already made strides to mitigate the issue at hand. A successful attack could lead to a breach to customer’s saved credentials and ultimately have them stolen. Since threat actors have information on their customers, this opens the door for brute forcing and social engineering attacks. Complete credit card information is not saved or archived in storages by LastPass.Īll customers of LastPass are potentially at risk. As for the unencrypted content, this contained website URLs and partial credit card information. The encryption/decryption process can only be done on their account locally on the LastPass client. These items remained encrypted since the encryption key can only be accessed through the user’s master password using LastPass’s proprietary (Zero Knowledge) architecture. The encrypted data included website credentials, secure notes, and form-filled data. LastPass disclosed that the data copied by the threat actor contained basic metadata of their customers, including company names, end-user names, billing addresses, email addresses, telephone numbers, and IP addresses of those accessing LastPass services.Īdditionally, the customer vault data was also copied which included both encrypted and unencrypted data, and partial credit card data.

The investigation for this August security incident is ongoing and this recent update includes additional information such as what was stolen by threat actors, remediation recommendations, and additional actions taken by LastPass. It is used to protect sensitive information and to provide easy log in access to services for automatic credential fill in. LastPass is a known password manager for clients to store credentials securely. Since LastPass’s production environment is on-premises and segmented from where the original breach occurred, they did not experience an outage with their services. This could potentially lead to threat actors discovering vulnerabilities in client’s software for exploitation or to execute a cyberattack on customers. This information was used to target an employee to obtain the keys to unlock storage volumes on their cloud-based environment. In this recent update, they have found that the source code, including other specific technical information were extracted from Lastpass’ production environment. LastPass first announced the security incident on a blog in August 2022.

LastPass recommends businesses to review and update their passwords, review their security measures, and stay vigilant for social engineering attacks on their accounts. The incident involved storages that contain production data and certain metadata of LastPass subscribers. LastPass provided an update to their August incident where an unauthorized access occurred in their cloud storages.

Lastpass security certificate