All sensitive customer vault data, other than URLs, file paths to installed LastPass Windows or macOS software, and certain use cases involving email addresses, were encrypted using our Zero knowledge model and can only be decrypted with a unique encryption key derived from each user’s master password. Cloud-based backup storage – contained configuration data, API secrets, third-party integration secrets, customer metadata, and backups of all customer vault data.

DevOps Secrets – restricted secrets that were used to gain access to our cloud-based backup storage.

Internal documentation – technical information that described how the development environment operated.

Internal scripts from the repositories – these contained LastPass secrets and certificates.

On-demand, cloud-based development and source code repositories – this included 14 of 200 software repositories.The data accessed from those backups included system configuration data, API secrets, third-party integration secrets, and encrypted and unencrypted LastPass customer data.” So, what data was accessed? The threat actor leveraged the vulnerability to deliver malware, bypass existing controls, and ultimately gain unauthorized access to cloud backups. We declared this incident closed but later learned that information stolen in the first incident was used to identify targets and initiate the second incident.” Incident 2Īgain from LastPass’ recent update: “The threat actor targeted a senior DevOps engineer by exploiting vulnerable third-party software. No customer data or vault data was taken during this incident, as there is no customer or vault data in the development environment. Incident 1įrom LastPass’ recent update: “A software engineer’s corporate laptop was compromised, allowing the unauthorized threat actor to gain access to a cloud-based development environment and steal source code, technical information, and certain LastPass internal system secrets. Here’s what happened, and what you can learn from the breach.

It proves that regardless of how sophisticated or careful a company is, with enough time and motivation, talented hackers can breach some parts of said system. The LastPass breach was a pretty stunning turn of events for a company on the cutting edge of cybersecurity best practices.

Lastpass mfa