lastpass password manager acknowledges breach

The company said at the time that as a precaution it was prompting all users to change their master passwords. Prior to that in June 2015, LastPass suffered a major data breach, in which the stolen data could have allowed hackers to guess weak master passwords.

In January 2016 a security researcher (Sean Cassidy) cast doubts on the security of LastPass when he claimed he had discovered a way of gaining login credentials, and even a two factor authentication code, through a phishing attack.Ĭassidy went public and publish his exploit on Github after notifying the firm two months previously, but he was not satisfied by their response.

LastPass thanked its users for their “patience, understanding and support.” Previous compromisesīut this is not the first time that LastPass has been compromised. It said that based on what it had learned and implemented, it is evaluating further mitigation techniques to strengthen its environment. “While our investigation is ongoing, we have achieved a state of containment, implemented additional enhanced security measures, and see no further evidence of unauthorised activity.” “In response to the incident, we have deployed containment and mitigation measures, and engaged a leading cybersecurity and forensics firm,” said the firm. The firm said its products and services are operating normally. The hacker apparently “took portions of source code and some proprietary LastPass technical information.” LastPass said that “unauthorised party” had gained access to portions of its development environment through a single compromised developer account. “After initiating an immediate investigation, we have seen no evidence that this incident involved any access to customer data or encrypted password vaults.”

“Two weeks ago, we detected some unusual activity within portions of the LastPass development environment,” the firm stated. LastPass confirmed a data breach on Thursday in a blog post in which it admitted the hackers had stolen source code and other technical data.īut it insisted that its prized data – namely its customer data and their encrypted password vaults – had not been compromised. Password management service LastPass is once again at the centre of a security scare, after it confirmed a recent ‘security incident.’

Lastpass password manager acknowledges breach