2022Data breach
LastPass breach
August to October 2022
Attackers first stole source code and technical information from LastPass's development environment, then used it to target a senior DevOps engineer. According to LastPass, they exploited a vulnerable third-party media software package on the engineer's home computer, installed a keylogger, and captured the engineer's master password to reach cloud storage holding backups, including encrypted customer vault data.
- Victim
- LastPass and its users
- Sector
- Technology (password management)
- Public attribution
- Not publicly attributed in the cited sources.
Impact
Copies of customer vault backups were taken; LastPass said sensitive vault fields were encrypted, while some fields such as website URLs were not.
Root cause
A small number of engineers with access to critical decryption keys could do so from a home computer that was not adequately protected.
Lessons learned: the controls it teaches
- Restrict access to critical keys to hardened, managed devices only.
- Treat an earlier breach as a source of material for the next attack, and rotate secrets accordingly.
- Encrypt all sensitive fields, including metadata, end to end.