Apparently, these keys were not changed immediately after the initial breach was identified, which may have prevented access to the cloud storage. It was determined that an unauthorized party, using the cloud storage access key and container decryption keys obtained in the August 2022 incident, was able to gain access to certain elements of our customers’ information.LastPass immediately launched an investigation, engaged Mandiant, a leading security firm, and alerted law enforcement.November 2022: LastPass detected unusual activity within a third-party cloud storage service, which is currently shared by both LastPass and its affiliate.There was no evidence that this incident involved any access to customer data or encrypted password vaults.There was no evidence of any threat actor activity beyond the established timeline.During this timeframe, the LastPass security team detected the threat actor’s activity and then contained the incident.The forensic investigation revealed that the threat actor’s activity was limited to a four-day period in August 2022. September 2022: LastPass completed the investigation and forensics process in partnership with Mandiant.August 2022: LastPass announces that unknown criminals used a single compromised developer account to gain access to the development environment, take portions of source code, and some proprietary technical information.Cyber-RISK: FFIEC Cybersecurity Assessment.Started with 1800 entries so still got a ways to go, plus my wife's account (though she only had about 300.

As I update or delete them, I move them out of the imported vault so I know how much I have left. I switched to 1Password (also considered BitWarden) and created a vault to import all my passwords into. Better to leave LP for a competitor and update your important passwords. Also, only part of your vault is encrypted, the URLs and when you visit them is in plain text so you are at higher risk of phishing attacks.Īt a minimum, update your important passwords (email, financial, etc) and your master password. How likely your vault is to be decrypted friends on how strong your master password is. Default now is 100,100 but mine was set at 500. What are your password iterations? They might be low if you are a long time customer and haven't updated your master password recently. 2FA to access the vault doesn't help they don't need access to your account, they downloaded the vault.

Lastpass vulnerabilities