LastPass attackers stole encrypted password vaults. If your master password is weak, hackers can crack it in hours, not years. Reset every password immediately, especially banking and email, enable two-factor authentication everywhere, and create a new 15-plus-character master password.
Chapters
If you are one of the millions of LastPass customers who had their encrypted password vault stolen as part of this recent data breach, this is what you need to know. I will tell you the 3 things you need to do, but first, let's briefly go over what happened in simple terms. Now, attackers were able to copy LastPass's customers' password vaults. These vaults contain lots of data about the services and web pages where the passwords are used. The passwords themselves were encrypted, but that does not mean they are safe. The encryption is based upon the length, complexity, and confidentiality of the master password that you use to unlock your password manager. LastPass is being criticized for their statements that it would take a million years for attackers to brute force their way into those vaults. Their statements are true for those who had long and complex passwords, but if your password was not long and complex, or if you use that password for other sites, then the attacker could decrypt your password in possibly hours or minutes. So here are the 3 things you need to do. First, change your passwords for every entry in your LastPass vault. Yes, every site, service, and tool. Every password needs to be reset. Start with the most important ones first, like banking and email services. Then work your way across all your saved passwords. While resetting your passwords, be sure to activate either second factor or multi-factor on those sites. That gives you an extra layer of security. And be sure to use entirely new and complex passwords. No incrementing numbers or changing an S to a dollar sign or something like that. That doesn't fool automated password hacking tools, which are pre-programmed to swap out those commonly altered characters. Number 2, make sure your LastPass master password is reset with a long, and we're talking 15 characters or more, complex password. That means you use uppercase and lowercase letters, numbers, and special characters. And be sure to turn on second factor authentication as well. Now, this won't protect the previously stolen vault, but it would help if in the future your vault is stolen again. Number 3: Be wary of social engineering attacks. The data thieves have a tremendous amount of unencrypted data about you, including the sites and services that you use. They can use this for very specific phishing attacks. So expect an increase in targeted phishing and spam coming your way. Many of them may use the fact that your LastPass vault was stolen and urgently ask you to click a link, a button, or open an attachment. Don't do it. Be smart when it comes to phishing. Now, I hope this helps all of those who had their LastPass password vault stolen. Act quickly to minimize the risk and change all of your passwords.
