lastpass password manager acknowledges breach

LastPass offers multi-factor authentication (MFA) as an additional line of defense against security breaches, but it must be manually enabled and also have its settings configured properly to actually provide the user with extra protection. This nearly happened at scale in 2019 when a vulnerability in the password manager’s Chrome extension was discovered, but it appears to have been patched out before it could be exploited by attackers. But LastPass says that this was a case of bots using lists of credentials from other data breaches in a “brute force” attack, with the customers who experienced unauthorized access attempts likely having re-used their email and password as their vault login.Īnd while attackers may not be able to get at user master passwords via the LastPass internal network, it is possible to capture them at the user end by compromising individual devices. Master passwords appeared to be accessed in a prior breach of the password manager in late 2021, as some users reported attempted logins from foreign countries using their valid credentials. It is difficult to assess the actual risk as LastPass developer GoTo is keeping quiet on details of what aspects of the source code and proprietary information were stolen. However, the encrypted vaults in which passwords are stored could potentially be compromised in a number of other ways. The password manager stores each user’s master password on their own local device, preventing a server compromise from exposing it in any way. The immediate danger to LastPass users from this security breach is, fortunately, minimal. Could stolen source code be leveraged for future compromise of password managers? The bad news is that the attacker made up with source code and some sort of proprietary information, which could potentially be used for future attacks.

The good news, at least in the short term, is that it appears user password vaults have not been compromised. The widely used password manager LastPass suffered a security breach that is a mix of good and bad news for its many users.

Lastpass password manager acknowledges breach