#Lastpass news code
#Lastpass news password

#Lastpass news password

In short, even if it ultimately turns out that the crooks could have made off with personal information such as home addresses, phone numbers and payment card details (though we hope that’s not the case, of course), your passwords are still as safe as the master password you originally chose for yourself, which LastPass’s cloud services never ask for, let alone keep copies of. ( Zero knowledge is a jargon term that reflects the fact that although LastPass holds some sort of data in its customers’ password vaults, it has no knowledge of what that data actually refers to, or even if it actually consists of account names and passwords at all.) Unfortunately, LastPass isn’t yet giving out any information about what sort of customer data was stolen, reporting simply that it is “working diligently to understand the scope of the incident and identify what specific information has been accessed”.Īll that LastPass can say for sure right now is to reiterate that “ur customers’ passwords remain safely encrypted due to LastPass’s Zero Knowledge architecture.” In other words, even if the criminals weren’t able to dig around in customer records directly from the account of the developer who got infected by malware back in August, it seems that the crooks nevertheless made off with internal details that indirectly gave them, or someone to whom they sold on the data, access to customer information later on. Right at the end of November 2022, however, LastPass further admitted that there was a bit more to the story than perhaps they’d hoped.Īccording to a security bulletin dated, the company was recently breached again by attackers “using information obtained in the August 2022 incident”, and this time customer data was stolen. In other words, even if password vault data had been stolen, it would have been unintelligible anyway. Therefore, any passwords stored into the cloud are encrypted before they’re uploaded, and only decrypted again after they’ve been downloaded. The master password used to unscramble your saved passwords is only ever requested and used in memory on your own devices.

#Lastpass news code

The company did admit, however, that the crooks had made off with LastPass proprietary information, notably including “some of our source code and technical information”, and that the crooks were in the network for four days before they were spotted and kicked out.Īccording to LastPass, customer passwords backed up on the company’s servers never exist in decrypted form in the cloud. LastPass insisted that the developer’s account hadn’t given the criminals access to any customer data, or indeed to anyone’s encrypted password vaults. With a beachhead on that computer, it seems that the attackers were then able to wait until the developer had gone through LastPass’s authentication process, including presenting any necessary multi-factor authentication credentials, and then “tailgate” them into the company’s development systems.

LastPass source code breach – incident response report releasedīriefly put, LastPass concluded that the attackers managed to implant malware on a developer’s computer.