LastPass, a popular password manager, announced that an unauthorized party accessed the company’s archived backups of its production data on a third-party cloud-based storage service. According to the company’s investigation, a threat actor accessed the cloud storage environment in August 2022 with information obtained from an earlier incident.

Although the threat actor did not access customer data in the August incident, some source code and technical information were stolen and used to target another employee. This allowed the threat actor to obtain credentials and keys to access and decrypt storage volumes within the cloud storage service.

According to LastPass, the cloud storage service accessed by the threat actor is physically separate from the production environment. However, the actor copied customer account information, including email addresses, company names, billing addresses, telephone numbers, end-user names, and IP addresses.

The threat actor copied a backup of the production data, including unencrypted data, such as URLs. In addition to the unencrypted data, encrypted sensitive information, like usernames and passwords, secure notes, and form-filled. The data is stored in a proprietary binary format, and the encrypted fields are protected by 256-bit AES encryption. The threat actor can only decrypt them with a unique encryption key. The encryption key is derived from the user’s master password via LastPass’ Zero Knowledge architecture.

The threat actor may attempt to guess customer master passwords using brute force to decrypt copies of vault data they obtained. LastPass has assured its customers that it would be challenging for them to do so because of the encryption methods used to secure the data. However, LastPass advises customers to remain vigilant against brute force, credential stuffing, or other phishing attacks on accounts associated with their LastPass vaults.

The company has taken several steps to address the issue and provide security for its customers. These include revoking the keys accessed by the threat actor, strengthening internal controls, and implementing additional security measures. Furthermore, the company is working with law enforcement and cybersecurity experts to investigate the issue further.

LastPass recommends that all customers follow best practices when creating and managing strong passwords as a precautionary measure. In addition, LastPass customers should remain vigilant and follow the recommended precautions to ensure the security of their personal information.

Related Posts - TKS Blog
TKS Newsletter - 2025 May
Here's our May 2025 Newsletter Read the full PDF version here: The TKS Sentinel - May Issue In this month's edition, we discuss: Cloud Security Teams Calls ...
Read more
bdr planbdr plan
How Business Owners Can Weather the Storm: IT Preparedness
Hurricane season officially begins on June 1st, and for business owners in Louisiana and along the Gulf Coast, that means now is the time to...
Read more
drpdrp
Windows 365 Introduces New Disaster Recovery Option
Why Data Loss Is a Business Killer Data loss can be devastating for any organization. From lost revenue to damaged customer trust, the consequences are real...
Read more
How Managed IT Services Help Solve Pressing IT Challenges
Why Businesses Are Turning to Managed IT Services By the end of 2025, the global IT services market is projected to reach a staggering $1.12 trillion....
Read more

Used with permission from Article Aggregator