lastpass password manager acknowledges breach

We have completed the investigation and forensics process in partnership with Mandiant. I wanted to update you on the conclusion of our investigation to provide transparency and peace-of-mind to our consumer and business communities. On August 25 th, 2022, we notified you about a security incident that was limited to the LastPass Development environment in which some of our source code and technical information was taken. Our recommendation is to keep using password managers like LastPass, turn on MFA where possible, and stay vigilant for any unusual password reset requests, or unexpected requests to approve logins.Update as of Thursday, September 15, 2022 Sadly, many still use plaintext files or even physical notes to write down passwords. LastPass, like other password managers, is an important tool for every person navigating today’s hyper connected world with dozens of accounts that should each have a unique and complex password, especially where no Multi Factor Authentication (MFA) is available. With that, based on available information, no customer data was impacted, nor any passwords breached. This is not their first public challenge.

I should note that, unfortunately, LastPass had some practice. Overall, I would give LastPass good marks in their initial response, of course time will tell as more details emerge over the next couple of days.

The email, I thought, was well worded, provided enough information, without disclosing too much. Being a customer of LastPass, I received and email from them hours before the story became public. This doesn’t, however, mean that access to the bank’s floor plan, or even being able to compromise one of the bank employees, necessarily means that any money will be stolen. Being able to understand how the particular software works can potentially help the malicious actor identify its weak points and ways of gaining entry.

Bad actors will want source code for the same reason bank robbers will want floor plans to a bank.

Lastpass password manager acknowledges breach