LastPass Hacked, But User Passwords Were Not Accessed
A hacker has infiltrated password manager LastPass, but the company’s initial investigation shows the intrusion only ensnared the company’s internal systems for software development —not any data concerning customer passwords.
On Thursday, LastPass sent out an email to customers about the breach, which the company detected about two weeks ago.
“We have determined that an unauthorized party gained access to portions of the LastPass development environment through a single compromised developer account and took portions of source code and some proprietary LastPass technical information,” the company said.
“We have no evidence that this incident involved any access to customer data or encrypted password vaults,” the message added.
In response, the company has deployed “containment and mitigation measures,” and hired a leading cybersecurity firm to investigate the intrusion. The company has also posted an FAQ(Opens in a new window) that notes all LastPass products and services have been operating normally, despite the breach.
LastPass hasn’t provided other details as the vendor embarks on the forensics investigation. But a major concern is whether the stolen proprietary data will pave the way for cybercriminals to uncover vulnerabilities in the company’s password management products.
For now, the company’s FAQ notes LastPass doesn’t store information on the “Master Password” customers use to access their accounts over the password management service. Instead, the company relies on a “zero knowledge” encryption model(Opens in a new window) to unlock access to a user’s account. This involves storing the Master Password on the customer's device only.
“At this time, we don’t recommend any action on behalf of our users or
Read more on pcmag.com
