LastPass Hacked, But User Passwords Were Not Accessed

A hacker has infiltrated password manager LastPass, but the company’s initial investigation shows the intrusion only ensnared the company’s internal systems for software development —not any data concerning customer passwords. 

On Thursday, LastPass sent out an email to customers about the breach, which the company detected about two weeks ago. 

“We have determined that an unauthorized party gained access to portions of the LastPass development environment through a single compromised developer account and took portions of source code and some proprietary LastPass technical information,” the company said. 

“We have no evidence that this incident involved any access to customer data or encrypted password vaults,” the message added. 

In response, the company has deployed “containment and mitigation measures,” and hired a leading cybersecurity firm to investigate the intrusion. The company has also posted an FAQ that notes all LastPass products and services have been operating normally, despite the breach.   

LastPass hasn’t provided other details as the vendor embarks on the forensics investigation. But a major concern is whether the stolen proprietary data will pave the way for cybercriminals to uncover vulnerabilities in the company’s password management products.

For now, the company’s FAQ notes LastPass doesn’t store information on the “Master Password” customers use to access their accounts over the password management service. Instead, the company relies on a “zero knowledge” encryption model to unlock access to a user’s account. This involves storing the Master Password on the customer's device only.

Recommended by Our Editors

Portland City Officials Accidentally Send Hacker $1.4 Million

Plex Asks All Users to Change Their Passwords Due to a Data Breach

Fake DDoS-Protection Pages on WordPress Sites Serve Up Malware

“At this time, we don’t recommend any action on behalf of our users or administrators,” the company’s FAQ adds. But for extra protection, consider activating the multi-factor authentication on your account. LastPass plans on updating customers about the investigation as it proceeds.

Neil J. Rubenking, PCMag's Lead Analyst for Security, received the email from LastPass but says he's not worried. Even if the accessed data had included encrypted password vaults, "the thief would have no way to get in without the password. And LastPass (like all password managers) never stores your password, only a hash of the password," he said.