Password manager LastPass hacked again for 2nd time this year

New Delhi, Dec 1 (IANS): Karim Toubba, the CEO of popular encrypted password manager LastPass, has admitted the company is investigating a security incident after its systems were compromised for the second time this year.

The company detected unusual activity within a third-party cloud storage service, which is currently shared by both LastPass and its affiliate, GoTo.

"We immediately launched an investigation, engaged Mandiant, a leading security firm, and alerted law enforcement," Toubba said in a statement late on Wednesday.

The earlier security breach in August this year had allowed hackers internal access to the company's systems for four days until they were detected and evicted.

Toubba said that an unauthorised party, using information obtained in the August 2022 incident, was again able to gain access to certain elements of "our customers' information".

"Our customers' passwords remain safely encrypted due to LastPass's Zero Knowledge architecture," said the CEO.

"We are working diligently to understand the scope of the incident and identify what specific information has been accessed. In the meantime, we can confirm that LastPass products and services remain fully functional," he informed.

LastPass is a freemium password manager that stores encrypted passwords online.

The company does not have any access to the master passwords of its customers' vaults.

"Without the master password, it is not possible for anyone other than the owner of a vault to decrypt vault data as part of our Zero Knowledge security model," according to the CEO.

He said that the company continues to deploy enhanced security measures and monitoring capabilities across its infrastructure to help detect and prevent further threat actor activity.



Top Stories

Leave a Comment

Title: Password manager LastPass hacked again for 2nd time this year

You have 2000 characters left.


Please write your correct name and email address. Kindly do not post any personal, abusive, defamatory, infringing, obscene, indecent, discriminatory or unlawful or similar comments. will not be responsible for any defamatory message posted under this article.

Please note that sending false messages to insult, defame, intimidate, mislead or deceive people or to intentionally cause public disorder is punishable under law. It is obligatory on Daijiworld to provide the IP address and other details of senders of such comments, to the authority concerned upon request.

Hence, sending offensive comments using daijiworld will be purely at your own risk, and in no way will be held responsible.