Even though the company has hardened minimum requirements for setting passwords, users can set master passwords weak enough to be susceptible to cracking attempts. More seriously, LastPass relies entirely on that user-selected master password to secure encrypted data. Within user vaults, however, website URLs associated with password entries weren’t encrypted. LastPass secures usernames, passwords, secure notes, and form-filled data using 256-bit AES encryption, and they can be decrypted only with a unique encryption key derived from each user’s master password. The stolen data included unencrypted customer account information (names, addresses, and phone numbers, but not credit card details) and encrypted customer vault data. This incident highlights weaknesses in LastPass’s approach to security. (Arguably, these events are all part of a single breach.) Although LastPass’s on-premises production environment was not breached, the attacker was able to leverage information captured in an earlier breach of a developer’s account in August 2022 to target another employee’s account in order to steal data from cloud-based storage that LastPass used for backup. LastPass has been fairly transparent about the breach, posting when it happened and following up this week with additional details. This safeguard should prevent the attackers from decrypting the stolen usernames and passwords. This could be a nightmare situation for LastPass, but most users shouldn’t be at significant risk because the company’s Zero Knowledge security architecture prevents it from having access to or knowledge of a user’s master password-the stolen data doesn’t contain any master passwords.

LastPass CEO Karim Toubba has announced that the password management company suffered a security breach last month, with attackers making off with unencrypted customer account data and customer vaults containing encrypted usernames and passwords.

LastPass Shares Details of Security Breach #1649: More LastPass breach details and 1Password switch, macOS screen saver problem, tvOS 16.3.3 fixes Siri Remote bug.#1650: Cloud storage changes for Box, Dropbox, Google Drive, and OneDrive quirky printing problem.

#1651: Dealing with leading zeroes in spreadsheet data, removing ad tracking from ckbk.

#1652: OS updates, DPReview shuttered, LucidLink cloud storage.

#1653: Apple Music Classical review, Authory service for writers, WWDC 2023 dates announced.

Lastpass secure notes