I received an unexpected Account Recovery SMS/Email for LastPass

jonsimon55

I received a text today "Your LastPass verification code" and then gave a code. I had not requested any code and in fact was sleeping at the time. I don't have LastPass authenticator installed. Is this a hack? Does this mean someone has my master password?

rachael.orovets

Hello Everyone,

Our security and engineering teams have recently observed potential “credential stuffing” attacks occurring. Credential stuffing attacks are events when a malicious or bad actor attempts to access user accounts (e.g., in this case, LastPass) using e-mail addresses and passwords obtained from third-party breaches related to other unaffiliated services. It is important to note that, based on your receipt of an unexpected SMS or Email account recovery request, it is very likely that any attempted access by a third-party has failed due to your use of two-factor authentication. Additionally, we want to reassure you that there is no indication that LastPass or LogMeIn were breached or compromised – these events appear to be entirely based on third-party breaches where individuals are attempting to take exposed e-mail addresses and passwords from unrelated and unaffiliated services and use them to gain access to other accounts.

We recommend immediately following the steps outlined here to make sure only you have access to your LastPass account, andenabling multi-factor authenticationon your account.

If you have reused your LastPass Master Password anywhere,we also recommend immediately changing your LastPass Master Password. As a reminder, you should never re-use your LastPass Master Password and should always have multi-factor authentication enabled for your LastPass account.

LastPass has many industry-standard protections in place, from various infrastructure level solutions, such as multiple web application firewalls, DDoS protection solutions, protections for managing Bot activities, and malicious request filtering engines, to various application-level protections where we limit unusual behaviors in various ways. Operating and keeping these tools up-to-date is a continuous effort and to keep you safe.

It’s very important that you use a strong Master Password and it should never be used as a password for any other website or app. Although you’re protected by the many layers ofencryption and security we put in place to keep your data safe, using a strong, unique Master Password will not only help to protect you from a brute-force attack but should also ensure that a breach at another random website won’t affect your LastPass account.

While we enforce industry-standard minimums when creating the Master Password(must be at least 12 characters long, at least 1 number, at least 1 lowercase and 1 uppercase letter), LastPass usersshould make their Master Password as strong as possible. Specifically, that means a Master Password should be long and unique, with a mix of character types.

To help ensure your LastPass and other online accounts are secured from bad actors or hackers, we recommend you follow these online best practices:

• Use a strong, secure master password for your LastPass account that you never disclose to anyone.
• Neverreuse passwords on multiple accounts, especially your LastPass Master Password. Use a different, unique password for every online account.
• We strongly advise using theLastPass Security Dashboardto identify websites saved in your vault where you’re re-using passwords. LastPass can help you replace those passwords with strong, unique onesusing our password generator tool.
• Enabledark web monitoringin the Security Dashboard. Once it’s on, you can relax knowing that LastPass is monitoring your account security for you. If an account is at risk, you will receive an alert in your email and in-product.
• Turn onmulti-factor authenticationfor LastPass and other services like your bank, email, Twitter, Facebook, etc.
• Beware ofphishing attacks.Do notclick on linksfrom people you don’t know, or that seem out of character from your trusted contacts and companies.
• Run antivirus, end-point protection, and/or anti-malware protection software, as well as regularly update your software and anti-virus signatures.
• Do regular backups (either locally or to the cloud) of your critical data – this will serve you very well in case of ransomware attacks and similar. If all else fails, you do have your data in a safe pace. Create a bi-weekly or bi-monthly habit to synch/run backup to catch up any changes.