nav[aria-label="Primary Navigation"] { padding: 0; & ul { list-style: none; width: 100%; display: flex; flex-direction: row; justify-content: start; align-items: start; gap: 30px; padding: 0; & li { margin: 0; } & ul li { list-style: none; } } }

Breached, and date of the breached backup

dabonz1965

Hello, I'm wondering if any of you find information on

How many % of users are exposed to this security breach, and if LastPass will eventually let us know if my data is involved in the breach.

The breached content was reportedly a backup vault, anyone know when is the date of the backup?

I think the information would be helpful for us individual users to determine our exposure. I haven't seen this information posted, any ideas?

Find more posts tagged with

Accepted answers

ash.canon

Hello, and thanks for your patience.

To answer some of your questions in short (the LastPass blog tends to be a little technical), here are the explanations:

We initially found out about the bad actor access in August, which means if you had an account prior to this date then you also had some vault data (login user names and passwords) backed up on LastPass servers, which was fully encrypted.
Unencrypted data included basic customer account information and related metadata including company names, end-user names, website URLs, billing addresses, email address, telephone numbers and IP addresses from which customers were accessing the LastPass service.
If your LastPass account password was very strong, there are no specific actions that you need to take in response to this potential access as your sensitive information remains encrypted within your vault. However, as always, we recommend staying vigilant and adhering to security best practices.

All comments

dabonz1965

Greetings,

This breach that has happened, is it concern ? What steps should be done ? I have sensitive information all my passwords and credit card information. This 2 times that LP have been hacked this year,I have left my security passwords to be full proof for all my accounts on the Web trusting LP.

Regards

katcherw

No, LastPass has not provided any further information about this. Many people are asking about this, but nobody has any answers. Most people are inferring that the stolen data contained everybody's vaults, but I don't think that was confirmed by the company yet.

logme

The fact that lastpass is saying basically nothing about this is the reason I'm getting rid of it. As of this year I've had an account for 10 years now, been a paying user for at least 8 of those years. I work in cybersecurity, and I well known that it's literally impossible to guarantee that you can create a 100% secure architecture. The fact that they were compromised in itself is bad, but otherwise wouldn't be enough for me to switch, or else I would have already done so by now.

But the fact that this happened in August, and here we are 4 months later and we keep getting new information from third parties, and furthermore that they've been less than forthcoming about the scope of the breach all this time later...No more, enough is enough. Speaks volumes about logmein as well, if they had any credibility they would have stepped in at some point. Two companies added to my bad list. I've begun the process of changing literally every single one of my passwords, and I have over 600 of them. What a royal PITA. All you can really do in a situation like this is vote with your wallet, and I'm definitely doing that with my family plan.

Alex Rourke

We noticed over the past week that a password for a service account that is rarely used and only in very specific environments appears to have been compromised last week. The only place that password was saved is in LastPass.

I too would love more details from LastPass, but I think at this point the best course of action is to change all of your passwords in your vault as quickly as possible and ask questions later. LastPass has already proven they lack credibility when assessing the risks associated with this breach, its hard to trust anything they say moving forward in any case.

stealth94rt

I'm just a user and not a security expert. The actions and statements from Lastpass from August 2022 forward have erroded trust, as seen by many posts on this forum, so I'm not sure that the community would firmly believe anything they say going forward.

Only you know what is in your vault and what damage could occur to you if the hackers brute-forced their way in.Therefore, the safest thing to do would be to assume that your vault backup was stolen and proceed accordingly.

katcherw

@AshC

Thank you for your responses here and elsewhere. I know that you aren't personally responsible for the breach or any design decisions.

However, I think it's worth pointing out that a lot of the frustration here is that LastPass doesn't seem to consider URLs as "sensitive information". The fact that criminals now have a list of all the URLs from my vault is very concerning to me. They have it regardless of how strong my password is or what my 2FA protection is. And all that information may be dumped publicly on the Internet to remain forever for the whole world to see. It doesn't take too much information to think of scenarios that this itself can be harmful to certain people:

Future employees can see the political sites I frequent.
If I visit porn sites I can be blackmailed
Financial sites can mark my accounts as valuable targets
Activists can face political retribution
My sexual orientation can be used to blackmail me or publicly humiliate me
Any site can be used as the basis of a sophisticated phish attempt
URL parameters can reveal a lot more personal information!

The fact that all this has been revealed but LastPass doesn't even consider it a problem is the worst part of this. It means they don't see any urgency in protecting this type of information in the future. I trusted LastPass to keep my secrets safe, but they failed and don't even seem to see the problem.

ash.canon

Hello, and thanks for your patience.

To answer some of your questions in short (the LastPass blog tends to be a little technical), here are the explanations:

We initially found out about the bad actor access in August, which means if you had an account prior to this date then you also had some vault data (login user names and passwords) backed up on LastPass servers, which was fully encrypted.
Unencrypted data included basic customer account information and related metadata including company names, end-user names, website URLs, billing addresses, email address, telephone numbers and IP addresses from which customers were accessing the LastPass service.
If your LastPass account password was very strong, there are no specific actions that you need to take in response to this potential access as your sensitive information remains encrypted within your vault. However, as always, we recommend staying vigilant and adhering to security best practices.

Steven Pocock

So the solution doesn't really answer anything any more clearly than the blog post.

How many % of users are exposed to this security breach,

Basically, we don't know, as LastPass has not released that information. The statement is 'a backup of customer vault data from the encrypted storage container'. If this is a complete backup, then EVERY LastPass customer is affected.

and if LastPass will eventually let us know if my data is involved in the breach.

Only LastPass can answer this and if it was just a small subset of users, they'd be saying that as a way to reduce the perceived severity of the issue. They aren't...so draw your own conclusion. They've had months to figure out the impact/scope of the breach...their silence speaks volumes. I'm assuming its a complete backup, or at least a significant percentage of their userbase.

The breached content was reportedly a backup vault, anyone know when is the date of the backup?

I think the information would be helpful for us individual users to determine our exposure. I haven't seen this information posted, any ideas?

LastPass either know this and are not disclosing, or don't know. I'm not sure which is worse. This makes me wonder if they only realized that this data had been accessed significantly later in the investigation - by which time any manner of additional data could have been compromised.

This breach that has happened, is it concern ?

Heck yes, this is at least the second major breach, and now this latest breach appears to be way more serious than what was originally stated.

What steps should be done ?

Change your master password. It won't fix the stolen data, but it will prevent them accessing your current data if they manage to guess your password.
Change any passwords you deem critical / sensitive and enable 2FA where you can. Don't use any similar patterns or templates that could be guessed from your old ones
Review all your 'notes' and see if anything in there is also sensitive (challenge questions, backup codes etc)
Probably don't save those new passwords / information in LastPass

This 2 times that LP have been hacked this year,I have left my security passwords to be full proof for all my accounts on the Web trusting LP.

Twice bitten....no longer shy. I'm cancelling my subscription and moving to an alternative. Class Action suits are already being lodged...it's going to be messy.

How much of a risk are your password at ?

That's hard to say, but computers get faster and faster all the time. What used to take YEARS with single-core single-thread tools 5 years ago, can now run in multi-threaded, multiple-core, multiple-GPU environments. Recent estimates say an 8 character, upper/lower/number/special password would take a 3090GPU about 40 minutes to bruteforce. A recent benchmark had a RTX4090 graphics card cutting that by 60%. And that's worst case - could be much shorter, and doesn't even use any 'tricks'. Crypto has lost a lot of it's profit incentive lately...and now there is a big chunk of data with a potential massive payoff that would be perfectly suited for all those graphics card based mining rigs to have a crack at. It's not a case of if...its just a case of when. Exactly how that could be applied to the stolen vault data is something only LastPass could answer...but having the source code for the product would certainly help in designing a cracking tool, so it's good that they didn't steal that as well.....oh wait...

cy.shimizu

Hi all,

I'm a previous user of LastPass and I'm wondering if my data was affected from this breach.

Thanks.

cy

Richard Marier

I think they just have no idea what was stolen in my opinion.

This is going to be a lot of trouble exporting every password , and deleting them from the vault , then changing everyone of them one by one.

They certainly deserver to be sued and I really hope they are .

They had only ONE job to do for the money we pay, it is to protect our assets and they failed miserably .

doug

Thanks everyone for posting your concerns. I consider this to be a very significant issue and one which LP is down playing for legal reasons. I have a few "technical" questions that I think need immediate answers:

1) Back in the day, LP used to ask how long you wanted your AES encryption and how many passes you wanted. These options are no longer visible (that I can find), so how can I verify how strong my encryption actually is?

2) I think we need a very clear explanation of exactly what is encrypted, software keys, notes etc? Some notes can contain very sensitive data.

3) Was this breach part of the tool kit breech? If not what steps did LP take to secure these systems post the first breech?

4) How can we know how secure our master passwords actually are?

Finally, by analogy: If one owns a very secure safe that is a good thing. If no one knows where you live, that you own the safe, or where it is in your house; there is little likelihood your safe will ever be tested. Thus, even if one had the codes to your safe, they would not have access to it to attempt to use them. This breech means that your safe is now sitting in the street with full access to anyone - something to ponder.

Furthermore, the claim that it will take a million years to crack your vault is wishful thinking and does not stand up to even the most casual review. Moore's law, quantum computing and other technologies will likely be able to make short work of AES encryption in the next 50 years if not in the next 10. Those with weaker passwords can expect their vaults will be broken in 2023. I might also observe there is a lot of crypto hardware sitting idle post the bitcoin etc fall from grace. All of this assumes state actors do not purchase certain vaults for targeted exploitation. We should also all hope some disruptive technology, leak in Apple's or Google's facial recognition or other such unexpected technical issue does not provide access to the master passwords down the road allowing keys and vaults to come together.

The prudent thing to do would be to change all passwords stored in one's vault. With hundreds and perhaps 1000s entries this will take many weeks, perhaps many hundreds of hours of work. Not all pwds are for web sites etc. after all. Email password changes may require resetting that pwd on many devices. Those devices attempting to use the old pwd until they are changed, will likely lock many user accounts requiring account resets etc.

Users with work VPNs or similar access systems will require company support and much reconfiguration to change these credentials. Professionals, consultants etc. with credentials for customer systems will require making disruptive changes to their customer's systems. To get back to anywhere near the level of security we had before the breech will take a very long time. In the meantime many will have little warning of a successful breech of our vaults. Hanging our hats on "They won't be able to break into the vault" is not a good strategy.

It seems that LP did not apply the level of security to management of our data as one entrusted with the credentials of millions of users would be expected to apply. Of course neither did the US Governments OPM, or the credit agencies, or many others.

So unless LP can explain why we should not all change our passwords and perhaps password managers, it would be prudent to get ahead of this disaster, stop sugar coating this and lay it out.

1) We need to change all pwds.

2) LP should develop systems to make this faster and easier.

3) LP should explain how they will secure our data going forward.

4) LP should lay out who is responsible and the disciplinary actions taken - after all a pilot who flies while intoxicated and endangers passengers is not allowed to keep their job. Security officers who flaunt the credentials of millions of users should be held to account. If an LP user's work/customer is compromised as a result of their stolen credentials - that user will most certainly be held to account.

I would like to stay with what I know but without more answers - as the old saying goes "Fool me once, shame on you, fool me twice shame on me." We need to know what has changed so that this does not happen in the future and why we should continue to trust this system. My 2 cents, if I am missing the mark please let me know why I should not be concerned.

ron.weasley

A very good question. I am in the same boat.

In theory, LP will have deleted your data when you closed your account. But I do wonder what was in those stolen backups. Was it simply a single backup of everyone's vault as of September 22nd? Or did the hack on September 22nd take a copy of all historical backups going back further?

For example if someone hacked my PC tomorrow and took a copy of my backup drive, they'd have all my data going back 4 years. Not just what's on my PC tomorrow.

Steven Pocock

@Greskrendtregk

Lastpass has been breached twice (arguably three times if you count this latest one as a breach and then a second attack using info from the first). They have had multiple vulnerabilities exposed that it has either been slow to address, or has never addressed. At some point, bad luck starts to look like bad practice.

You are right, you cannot 100% prevent any employee from being a victim of phishing, but you can implement practices and procedures that make it extremely difficult for any one set of credentials to be able to retrieve highly sensitive data, and then extract that data from within the internal networks. DLP practices, compartmentalization, zero-trust, RASIC etc can all be used. 'Test' data should never have real user data in it etc. "Developers" should never have access to real client data. Administrative access should be MFA secured. All access should be logged. Critical data access should set off alerts. None of these things are rocket science, the industry does this for PCI, PII, HIPPA, GPDR all day every day. I can't even access my corporate email without a username, password and physical token...let alone access a production (or even development) system. I am concerned that the explanation of how this happened seems to hint that these normal practices were not being followed.

None of this takes away from the fact that real people's data is now out in the wild. We only have LastPass's word that that data is truly encrypted, and we know that at least some of it is NOT (urls, metadata etc). LastPass continues to tell people not to worry, and that their data is encrypted...which doesn't seem to match with what other researchers have said. We still don't know any specifics about the scope or specific data that was actually breached. We also don't know if the vulnerabilities utilized in the last breach have been resolved.I'm sure LastPass know exactly what was taken, when and how. The fact they are not providing that information is concerning.

At some point, it starts to become prudent to take your money to another bank that HASN'T been robbed...rather than the one that appears to have been robbed 3 times in six months, and refuses to tell you what was stolen, how it was stolen, and how they're preventing it from being stolen in the future.

Troy Hairston

CyberSecurity works on what is known and not known. What that means is that I will have more trust in a company that has detected a breach and made the breach public than trusting that because a company hasn't detected a breach or openly made it public that they have been breached, that they are secure and trustworthy. A company can be breached and not know it. Those leaving LastPass to move to a different company could be moving to a company that is breached and not know it.

katcherw

@Greskrendtregk

Yes, that is true. But it still remains that I pay LastPass to do one job: keep my secrets safe. They failed. Not only is the only thing stopping hackers from reading all my passwords is the strength of my password, but they already have all my URLs and other metedata which LastPass failed to encrypt. Spending weeks changing all my passwords is not an acceptable outcome from using their product.

In previous breaches, I had your attitude. I figured the hackers didn't get any sensitive data, so that just proves LastPass' measures were good. I wasn't worried. But now they actually got my data. And we were told information that was never disclosed by LastPass before: that they don't encrypt everything in our vaults, despite them implying otherwise on their website. And they backup the vaults on a 3rd party cloud.

Yes, the other password managers will also suffer breaches, and we don't know if they will detect them or not. But at least 1Password encrypts the entire vault, not just some of it, and they encrypt the vault with an additional secret key instead of me worrying if my password has enough entropy. So regarding known vs unknown, I'm choosing to migrate to a manager that has better known security than a manager that has known insecurity.