LastPass users’ vault stolen

LastPass has a very serious cybersecurity incident. They have just made this announcement. The crucial part of this announcement is:

The threat actor was also able to copy a backup of customer vault data from the encrypted storage container which is stored in a proprietary binary format that contains both unencrypted data, such as website URLs, as well as fully-encrypted sensitive fields such as website usernames and passwords, secure notes, and form-filled data. These encrypted fields remain secured with 256-bit AES encryption and can only be decrypted with a unique encryption key derived from each user’s master password using our Zero Knowledge architecture. As a reminder, the master password is never known to LastPass and is not stored or maintained by LastPass. 

Simply put, their users’ password vaults that are stored on the cloud (on LastPass’s servers) are stolen!

If you are a LastPass user, there is one consoling fact: Since LastPass makes it their business NOT to know your master password, hackers cannot know it either. As long as hackers cannot guess your master password, they will not be able to decrypt your password vault.

If you are a LastPass user, what do you need to know and do?

Exclusive Content

To read the rest of this exclusive content, you need to sign up for a membership plan here for only $1.49/MONTH.

If you are already a member, please sign in here.

Leave a Reply

This site uses Akismet to reduce spam. Learn how your comment data is processed.

FREE: Top 10 Things You Must Do to Avoid Getting Hacked

Subscribe to our Cybersecurity News, Insights & Updates to get this FREE guide on how to avoid getting hacked!

* indicates required