Home LastPass Users’ Vault Stolen

LastPass Users’ Vault Stolen

The User's Profile iSecurityGuru December 24, 2022
placeholder image

LastPass has a very serious cybersecurity incident. They have just made this announcement. The crucial part of this announcement is:

The threat actor was also able to copy a backup of customer vault data from the encrypted storage container which is stored in a proprietary binary format that contains both unencrypted data, such as website URLs, as well as fully-encrypted sensitive fields such as website usernames and passwords, secure notes, and form-filled data. These encrypted fields remain secured with 256-bit AES encryption and can only be decrypted with a unique encryption key derived from each user’s master password using our Zero Knowledge architecture. As a reminder, the master password is never known to LastPass and is not stored or maintained by LastPass.

Simply put, the users’ password vaults that are stored on the cloud (on LastPass’s servers) are stolen!

If you are a LastPass user, there is one consoling fact: Since LastPass makes it their business NOT to know your master password, hackers cannot know it either. As long as hackers cannot guess your master password, they will not be able to decrypt your password vault.

If you are a LastPass user, what do you need to know and do?

Changing the master password alone will not help

Your password vault that is stored on LastPass’s servers is encrypted with a cryptographic key that is derived from your master password.

The rest is exclusive content for members

Curious about what being a member offers? Sign up now for a risk-free trial and get a sneak peek into the premium content, features, and perks awaiting you on the other side.


Top Comment

One alternative is to use an offline password manager. Basically, the password database is stored in a file that is stored locally on your device-...
Anonymous Author by isecurityguru
Image | ImmuneMist


Learn more
Image | Gold Newsletter

Gold Newsletter

Learn more