LastPass hacked, but user passwords were not accessed
A hacker has infiltrated password manager LastPass, but the company’s initial investigation shows that the breach only captured the company’s internal software development systems – not customer password data.
On Thursday, LastPass sent out an email to customers about the breach, which the company discovered about two weeks ago.
“We have determined that an unauthorized party gained access to portions of the LastPass development environment through a single compromised developer account and took portions of the source code and some proprietary LastPass technical information,” the company said.
“We have no evidence that this incident involved any access to customer data or encrypted password vaults,” the statement added.
In response, the company has implemented “containment and mitigation measures” and hired a leading cybersecurity firm to investigate the breach. The company has also posted an FAQ(Opens in a new window) which notes that all LastPass products and services have been operating normally, despite the breach.
LastPass has not provided any other details as the vendor begins its investigation. But a major concern is whether the stolen proprietary data will pave the way for cybercriminals to uncover vulnerabilities in the company’s password management products.
Currently, the company’s FAQ notes that LastPass does not store information about the “Master Password” customers use to access their accounts through the password management service. Instead, the company relies on a “zero knowledge” encryption model(Opens in a new window) to unlock access to a user’s account. This only involves storing the master password on the customer’s device.
Recommended by our editors
“At this time, we do not recommend any action on behalf of our users or administrators,” the company’s FAQ adds. However, for added protection, consider enabling multi-factor authentication(Opens in a new window) on your account. LastPass plans to update customers on the investigation as it continues.
Neil J. Rubenking, PCMag’s principal security analyst, received the email from LastPass, but says he’s not concerned. Even if the available data had included encrypted password vaults, “the thief would have no way to get in without the password. And LastPass (like all password managers) never stores your password, only a hash of the password,” he said.
Do you like what you read?
Sign up SecurityWatch newsletter for our best privacy and security stories delivered straight to your inbox.