LastPass was hacked, but it says no user data was compromised

In August, LastPass yes admit that an “unauthorized party” has infiltrated its system. Any news of a password manager being hacked could be alarming, but the company is now reassuring users that their logins and other information were not compromised during the event. this.

In his Latest updates Regarding the incident, LastPass CEO Karim Toubba said the company’s investigation with cybersecurity firm Mandiant revealed that the bad guys had insider access to their systems for four days. They were able to steal some of the password manager’s source code and technical information, but their access was limited to the service’s development environment not connected to customer and repository data. encrypted money. Furthermore, Toubba points out that LastPass doesn’t have access to users’ master passwords, which are needed to decrypt their vaults.

The executive said there was no evidence that the incident was “related to any access to customer data or encrypted password vaults.” They also found no evidence of unauthorized access after those four days and any trace that the hacker injected malicious code into the system. Toubba explained that the bad guys were able to get into the service’s system by infiltrating the developer’s endpoint. The hacker then impersonated the developer “when the developer has successfully authenticated using multi-factor authentication.”

Back in 2015, LastPass security breach email addresses, authentication hashes, password prompts, and other user information are compromised. A similar breach would be even worse today, when the service is said to have more than 33 million registered customers. While LastPass doesn’t ask users to do anything this time to keep their data secure, it’s good practice to not reuse passwords and enable multi-factor authentication.