LastPass suffered a major breach when an attacker compromised a senior engineer's home computer and stole one of only four corporate cloud decryption keys, potentially exposing all customer vault data. The company has a pattern of hiding breaches and downplaying risks. Users should immediately secure or migrate their passwords to a more trustworthy manager.
Chapters
What is going on with LastPass? This security company specializing in providing consumers with secure password vaults has suffered a number of serious cybersecurity crisis and then amplified those situations themselves through poor management decisions. In the latest series of issues, they were hacked but then concealed it, When they did announce it, they minimized the real risks, saying that customer sensitive data was not exposed. Eventually, they did admit that there was a risk of exposure to their customers' private data, but tried to placate users by downplaying the risks. Cybersecurity experts have universally criticized how LastPass has conducted itself. In short, they have proven themselves not trustworthy when it comes to how they operate. And that is not the end of the story, because as of February 27th, 2023, a new revelation was made which reveals even more serious security incidents and indications that point to a lack of security controls and acumen for their internal development environments. Let me summarize. This is what happened, and by the way, the details can be found on their web page. Okay, first off, a senior DevOps engineer's home system was hacked, and his password, which was protected by the company's very own password manager product, was compromised. This was one of only 4 people who had access to the super secret corporate corporate cloud decryption keys. The attacker was then able to somehow bypass the multi-factor authentication implementation, which should not really be possible if it's done correctly, and this allowed them to gain access to the company's encrypted cloud-based storage services, which house backups of all LastPass customer and encrypted vault data. Not surprisingly, the victorious hacker then downloaded all of the sensitive bits. This attack may actually grant the capability to decrypt the data that had been previously stolen from a prior attack, putting their customers at serious risk. The official press release contained a decent amount of data, so they have learned something. But it did omit when this all occurred. It also outlines a number of responses conducted after the attack, which are pretty standard best practices that should have been instituted long ago, especially for a security products company. Overall, the latest incident should be the last nail in their coffin. You know what I did there with last? Actually, their last breach should have been the last nail. I kind of see this as just the final death spiral and perhaps some twitching from a cold corpse which has proven unworthy of trust by its consumers, by its clients. Many users have already divorced themselves from LastPass and moved on to more trustworthy vendors. That is what I and other experts have recommended. If you are one of the remaining customers, or you were a previous customer, 'cause they may still have a copy of your vault, you need to take ownership of your security and not rely exclusively on the protections or behaviors provided by LastPass. Check out my previous video on what you must do to protect your potentially exposed passwords. I'll put the link in the comments and it gives you a clear step-by-step understanding of what needs to be done. Please act fast because you are in a race. The attackers may be able to decrypt your password vault and get access to your credentials. So be smart, be safe.
