LastPass Suffers Another Breach, and This Time Customer Data Is Affected

The data breachLastPasssuffered in August enabled a hacker to infiltrate the company again and steal customer information.

On Wednesday, LastPass announced it was investigating the breach, which involved a third-party cloud storage service connected to company systems.

“We have determined that an unauthorized party, using information obtained in the August 2022 incident, was able to gain access to certain elements of our customers’ information,” the company wrote in ablog post(Opens in a new window).

Tweet(Opens in a new window)

What data was stolen remains unclear. But LastPass has said customers' passwords should remain safe, since the companydoesn’t store(Opens in a new window)information on the “Master Password” customers use to access the encrypted password vaults over the platform.

“We are working diligently to understand the scope of the incident and identify what specific information has been accessed. In the meantime, we can confirm that LastPass products and services remain fully functional,” the company said.

Still, the incident shows theAugust breachat LastPass was more serious than initially thought. At the time, the company said the August breach only ensnared its internal systems for software development —not any data concerning customer passwords. Nevertheless, the hacker was able to steal portions of company source code and some proprietary LastPass technical information, which likely paved the way for the follow-up intrusion.

In September, LastPass also said it had concluded itsinvestigationinto the breach with the help of cybersecurity firm Mandiant. The results found the hacker only had access to the internal systems for four days. No evidence was found of any tampering either. But it seems LastPass still failed to uncover all the potential ways the hacker could use the access to breach the company again.

我们推荐的编辑

US Indicts Ukrainian for 'Raccoon Stealer' Malware That Hit Millions of Computers

Hacker Phishes Dropbox to Steal Access to Company Code

What to Do When You've Been Hacked

LastPass didn’t name the third-party cloud storage service the hacker used to breach the company for a second time. But LastPass has been sharing the cloud storage service with its affiliate GoTo. Both companies are currentlyownedby private equity firms.

In response to the new breach, LastPass has deployed additional security measures and monitoring of the company’s IT infrastructure. It's also contacted Mandiant and law enforcement about investigating the hack.