LastPass has admitted to a massive hack that resulted in users' passwords being stolen. The breach, first reported in August, was initially played down by the company.
More:
- The company stated that hackers have stolen information such as company names, end-user names, billing addresses, email addresses, telephone numbers, IP addresses, and customer vault data from the encrypted storage service.
- Those accounts that use the encrypted storage service should be safe since they are the only ones who know their master password, as it is not stored in the company's servers.
- According to LastPass, the threat actor did not breach credit card information.
- Customers have been advised to change their passwords, with a particular highlight on customers that have reused passwords or have created weak passwords. Generating stronger passwords would protect the breached accounts from brute-force attacks, which is likely to be the method used by the threat actor in this case.
- The threat actor responsible for this breach is unknown so far.