LastPass, one of the world's most popular password managers, is yet again under the microscope after its latest security breach.
In late December, LastPass CEO Karim Toubba acknowledgedthat a security incident the company first disclosed in August had ultimately paved the way for an unauthorized party to steal customer account information and vault data. This is the latest in a lengthy string of security incidents involving LastPass thatdate back to 2011.
It's also the most alarming.
An unauthorized party now has access to unencrypted subscriber account information like LastPass usernames, company names, billing addresses, email addresses, phone numbers and IP addresses, according to Toubba. That same unauthorized party also has a copy of customer vault data, which includes unencrypted data like website URLs and encrypted data like the usernames and passwords for all the sites customers have saved in their vaults. If you're a LastPass subscriber, the severity of this breach should have you looking for a different password manager because your passwords and personal data are at risk of being exposed.
What should LastPass subscribers do?
The company didn't specify how many users were affected by the breach, and LastPass didn't respond to CNET's request for additional comment on the breach. But if you're a LastPass subscriber, you need to operate under the assumption that your user and vault data are in the hands of an unauthorized party with ill intentions. Though the most sensitive data is encrypted, the problem is that the threat actor can run "brute force" attacks on those stolen local files. LastPass estimates it would take "millions of years" to guess your master password -- if you've followed its best practices.
If you haven't -- or if you just want total peace of mind -- you'll need to spend some serious time and effort changing your individual passwords. And while you're doing that, you'll probably want to transition away from LastPass, too.
With that in mind, here's what you need to do right now if you're a LastPass subscriber:
1. Find a new password manager. Given LastPass' history with security incidents and considering the severity of this latest breach, now's a better time than ever to seek an alternative.
2. Change your most important site-level passwords immediately. This includes passwords for anything like online banking, financial records, internal company logins and medical information. Make sure these new passwords are strong and unique.
3. Change every single one of your other online passwords. It's a good idea to change your passwords in order of importance here too. Start with changing the passwords to accounts like email and social media profiles, then you can start moving backward to other accounts that may not be as critical.
4. Enable two-factor authentication wherever possible. Once you've changed your passwords, make sure to enable 2FA on any online account that offers it. This will give you an added layer of protection by alerting you and requiring you to authorize each login attempt. That means even if someone ends up obtaining your new password, they shouldn't be able to gain access to a given site without your secondary authenticating device (typically your phone).
5. Change your master password. Though this doesn't change the threat level to the stolen vaults, it's still prudent to help mitigate the threats of any potential future attack -- that is, if you decide you want to stay with LastPass.
LastPass alternatives to consider
- Bitwarden: CNET's top password manager is a highly secure and open-source LastPass alternative. Bitwarden's free tier allows you to use the password manager across an unlimited number of devices across device types. Read our Bitwarden review.
- 1Password: Another excellent password manager that works seamlessly across platforms. 1Password doesn't offer a free tier, but you can try it for free for 14 days.
- iCloud Keychain: Apple's built-in password manager for iOS, iPadOS and MacOS devices is an excellent LastPass alternative available to Apple users at no additional cost. iCloud Keychain is secure and easy to set up and use across all of your Apple devices. It even offers a Windows client, too, with support for Chrome and Edge browsers.
How did it come to this?
In August 2022, LastPass published a blog post written by Toubba saying that the company "determined that an unauthorized party gained access to portions of the LastPass development environment through a single compromised developer account and took portions of source code and some proprietary LastPass technical information."
At the time, Toubba said that the threat was contained after LastPass "engaged a leading cybersecurity and forensics firm" and implemented "enhanced security measures." But that blog post would be updated several times over the following months as the scope of the breach gradually widened.
On Sept. 15, Toubba updated the blog post to notify customers that the company's investigation into the incident had concluded.
"Our investigation revealed that the threat actor's activity was limited to a four-day period in August 2022. During this timeframe, the LastPass security team detected the threat actor's activity and then contained the incident," Toubba said. "There is no evidence of any threat actor activity beyond the established timeline. We can also confirm that there is no evidence that this incident involved any access to customer data or encrypted password vaults."
Toubba assured customers at the time that their passwords and personal data were safe in LastPass's care.
However, it turned out that the unauthorized party was indeed ultimately able to access customer data. On Nov. 30, Toubba updated the blog post once again to alert customers that the company "determined that an unauthorized party, using information obtained in the August 2022 incident, was able to gain access to certain elements of our customers' information."
Then, on Dec. 22, Toubba issued a lengthy update to the blog post outlining the unnerving details regarding precisely what customer data the hackers were able to access in the breach. It was then that the full severity of the situation finally came to light and the public found out that LastPass customers' personal data was in the hands of a threat actor and all of their passwords were at serious risk of being exposed.
Still, Toubba assured customers who follow LastPass's best practices for passwords and have the latest default settings enabled that no further action on their part is recommended at this time since their "sensitive vault data, such as usernames and passwords, secure notes, attachments, and form-fill fields, remain safely encrypted based on LastPass' Zero Knowledge architecture."
However, Toubba warned that those who don't have LastPass's default settings enabled and don't follow the password manager's best practices are at greater risk of having their master passwords cracked. Toubba suggested that those users should consider changing the passwords of the websites they have stored.
What does all of this mean for LastPass subscribers?
The initial breach ended up allowing the unauthorized party to access sensitive user account data as well as vault data, which means that LastPass subscribers should be extremely concerned for the integrity of the data they have stored in their vaults and should be questioning LastPass's capacity to keep their data safe.
If you're a LastPass subscriber, an unauthorized party may have access to personal information like your LastPass username, email address, phone number, name and billing address. IP addresses used when accessing LastPass were also exposed in the breach, which means that the unauthorized party could also see the locations from which you used your account. And because LastPass doesn't encrypt users' stored website URLs, the unauthorized party can see all of the websites for which you have login information saved with the password manager (even if the passwords themselves are encrypted).
Information like this gives a potential attacker plenty of ammunition for launching a phishing attack and socially engineering their way to your account passwords. And if you have any password reset links stored that may still be active, an attacker can easily go ahead and create a new password for themselves.
LastPass says that encrypted vault data like usernames and passwords, secure notes and form-filled data that was stolen remains secured. However, if an attacker were to crack your master password at the time of the breach, they would be able to access all of that information, including all the usernames and passwords to your online accounts. If your master password wasn't strong enough at the time of the breach, your passwords are especially at risk of being exposed.
Changing your master password now will, unfortunately, not help solve the issue because the attackers already have a copy of your vault that was encrypted using the master password you had in place at the time of the breach. This means the attackers essentially have an unlimited amount of time to crack that master password. That's why the safest course of action is a site-by-site password reset for all of your LastPass-stored accounts. Once changed at the site level, that would mean the attackers would be getting your old, outdated passwords if they managed to crack the stolen encrypted vaults.
For more on staying secure online, here are data privacy tips digital security experts wish you knew and browser settings to change to better guard your information.
FAQs
Is LastPass safe to use? LastPass is safe because it uses the AES 256-bit cipher to encrypt your passwords. Passwords reach their servers only in an encrypted form. It ensures that even if hackers managed to breach the server, your data would still be safe.
What happened with LastPass? ›
LastPass said hackers had stolen copies of the list of user names and passwords of every customer from the company's servers. This breach was one of the worst things that could happen to a security product designed to take care of your passwords.
Is there anything better than LastPass? ›
1Password — Best Alternative to LastPass in 2023. 1Password is better than LastPass in a lot of areas. It provides more high-security features, it's easier to use, and it has a better family plan than LastPass.
What if a password manager is breached? ›
Another potential negative aspect of a password manager is if the password manager itself is breached. However, even if a breach occurs, the data in your password manager should be encrypted and stored elsewhere, and password managers do not retain your master password.
What are the disadvantages of LastPass? ›
Pros & Cons of LastPass
| Pros | Cons |
|---|
| Impressive free features | Costly compared to the competition |
| Solid (if somewhat dated) user interface | Poor customer support |
| Automatically syncs between all devices | |
| Strong security and encryption framework | |
1 more rowDec 6, 2022
The Best Password Managers
We've added details about the LastPass data breach. 1Password and Bitwarden remain our picks. Almost everyone should use a password manager. It's the most important thing you can do—alongside two-factor authentication—to keep your online data safe.
Can hackers get into LastPass? ›
LastPass has suffered hacks of its service in previous years, with notable incidents including 2015's unauthorized access of user account email addresses, password reminders, and authentication hashes. Other security lapses include 2017's browser extension vulnerability, which allowed websites to steal passwords.
How many times has LastPass been hacked? ›
The company seems to suffer through some sort of cyber faux pas year or two. From a mysterious security issue back in 2011 to a hacking episode in 2015 to vulnerabilities discovered in 2016, 2017, and 2019, LastPass has had its share of problems.
Should I change from LastPass? ›
Personal details and password vaults containing the sign-in credentials of millions of users are now in the hands of criminals. If you've ever used the password manager, LastPass, you should change all of your passwords for everything, now. And you should immediately take further measures to protect yourself.
What is the number 1Password manager? ›
Best paid password manager for multiple platforms
If you're looking for a trusted password manager app to keep your login information private and secure, 1Password is the best password manager for the task, letting you access your accounts and services with one master password.
What can I use in place of LastPass? ›
Seven free alternatives to the LastPass password manager
- Bitwarden. Bitwarden is one of the most complete free password managers out there. ...
- Zoho Vault. Zoho Vault is part of Zoho's collection of productivity apps. ...
- Dashlane. ...
- LogMeOnce. ...
- NordPass. ...
- RoboForm.
Large-scale password breaches are a common occurrence. To protect their users' accounts and data after these breaches, companies often attempt to convince their users to change their passwords on the affected sites.
What should you do immediately if you think your password has been compromised? ›
7 Steps to take after your personal data is compromised online
- Change your passwords. ...
- Sign up for two-factor authentication. ...
- Check for updates from the company. ...
- Watch your accounts, check your credit reports. ...
- Consider identity theft protection services. ...
- Freeze your credit. ...
- Go to IdentityTheft.gov.
Data leaks can reveal everything from social security numbers to banking information. Once a criminal has these details, they can engage in all types of fraud under your name. Theft of your identity can ruin your credit, pin you with legal issues, and it is difficult to fight back against.
Why dont people use password managers effectively? ›
Users of built-in password managers often adopted them for reasons of convenience or due to seeing prompts. Accordingly, they often did not use them in effective or secure ways because they (perhaps incorrectly) believed themselves to be at low risk or because they did not have sufficient knowledge.
Does LastPass detect compromised passwords? ›
LastPass monitors your email addresses continuously within a database of breached credentials and immediately alerts you via email if they have been compromised.
How often should I change my LastPass master password? ›
So you should hardly ever change your master password; essentially, only when there's a security reason to do so. The only times you should change your master password are when: You logged in to your password manager on a device infected with spyware or other malware.
When should you not use a password manager? ›
Why You Shouldn't Use a Password Manager
- You Could Forget Your Master Password. ...
- Not all Devices are Secure. ...
- They Don't Work on all Browsers and Devices. ...
- There Might Not be a Backup. ...
- The Service Itself Could be Bad. ...
- The Cost. ...
- The Risks of a Single Sign-on System. ...
- They Don't Do Your Memory any Favors.
The biggest disadvantage of a password manager is that because access to all of your passwords is protected by a single strong password, there is the potential risk that an attacker could gain access to all of your passwords with one hack of your password manager.
iCloud Keychain is Apple's own password management system and it is built into macOS and iOS. It helps you to create secure passwords by generating them on your behalf, warns you if you reuse one or if a password is not secure, and, crucially, auto-fills your passwords when needed.
Was LastPass hacked recently? ›
It's time to start changing your passwords
Password manager giant LastPass has confirmed that cybercriminals stole its customers' encrypted password vaults, which store its customers' passwords and other secrets, in a data breach earlier this year.
What password do most hackers use? ›
“123456” is #1 on the Hacker's List for a reason – this password is THE most popular one worldwide (0.62% of 9.3M passwords analyzed). It also holds the: #1 spot for . edu, Germany, Italy, and Spain users.
How did LastPass master passwords get compromised? ›
In a statement, LastPass explained that the August breach saw a malicious actor steal source code and technical information from LastPass' development environment that was then used to target an employee.
Why did LastPass disappeared from Chrome? ›
If the extension has disappeared
If your LastPass browser extension is suddenly missing, it may still be installed but was hidden from your toolbar menu. You can change your toolbar settings to show the LastPass browser extension again.
Why are all my LastPass passwords at risk? ›
A password is considered "at-risk" if it is weak, reused, or missing for the site entry in your vault. You can view these passwords that need attention from within your vault on the Passwords page, or from the Password Security page via the Security Dashboard.
Is LastPass more secure than 1Password? ›
Both password managers send only encrypted data to the provider's servers. Multi-factor security slightly tips in the LastPass favor. However, data storage options are undeniably better on 1Password's end. Privacy and third-party audits are areas in which 1Password wipes the floor with LastPass.
Should I be worried about LastPass breach? ›
No. This incident did not compromise your Master Password. We never store or have knowledge of your Master Password. We utilize an industry standard Zero Knowledge architecture that ensures LastPass can never know or gain access to our customers' Master Password.
Can I delete my LastPass account and start over? ›
Click Delete to start the process of permanently and irreversibly deleting your LastPass account and all of your data, including Sites, Secure Notes, and Form Fills. Everything you had in LastPass will be gone. Forever. You can review your deletion before it's final.
Should I use LastPass or Google Chrome? ›
Although Chrome Password Manager is free and convenient to use, Last Pass offers more security and privacy features. Since the goal of a password manager is to protect your passwords, Last Pass is the better choice. However, you must upgrade to Last Pass's Premium plan to access Last Pass on unlimited devices.
Reynolds is also an investor in 1Password, alongside fellow stars Robert Downey Jr. and Justin Timberlake.
Has 1Password ever been hacked? ›
1Password has never been hacked
But even if our infrastructure were to be breached in the future, you can rest assured your data wouldn't be at risk. Every decision we make at 1Password begins and ends with the safety and privacy of your information.
Which password manager is better than 1Password? ›
Ultimately, Keeper is a better password manager than 1Password. Its strong security with unyielding encryption and authentication options are a huge plus.
Why is LogMeIn selling LastPass? ›
LogMeIn CEO Bill Wagner says the plan to spin out LastPass wasn't connected with the backlash over the paywall, and 75% of revenues for the password manager now came from corporate clients. “It's all about unlocking the value of this company,” says Wagner.
How does LastPass free make money? ›
We come from the enterprise software-as-a-service (SaaS) market. Our freemium model allows users to upgrade for additional features and benefits, which ensures that we continue to develop and improve the product.
How much does LastPass cost per year? ›
1Password and LastPass both cost $36/year for unlimited devices and passwords. Keeper has a very limited Free version available on 1 mobile device, while LastPass is available on unlimited devices of one type (computer or mobile).
Is LastPass stored locally or in the cloud? ›
Your LastPass vault data (e.g., URLs, usernames and site passwords, secure notes, form fill items) is stored locally on your computer, and the storage location is dependent on the operating system(s) and web browser(s) you use.
What is better Apple keychain or LastPass? ›
The best password manager for iPhones and iPads doesn't come from Apple – in our view, the best choice you can make is LastPass, closely followed by the likes of Dashlane and 1Password. Yes, Apple's own iCloud Keychain is a great tool for remembering passwords on your iPhone.
What is the difference between LastPass and LastPass premium? ›
Some key features that differ between the Free and Premium versions are that with Premium, you get dark web monitoring, multiple device usage and a security dashboard that scores your password security. Paid plans also allow you to give another user one-time access to your vault in case of an emergency.
What is the first thing you should change if you are hacked? ›
Step 1: Change your passwords
This is important because hackers are looking for any point of entry into a larger network, and may gain access through a weak password. On accounts or devices that contain sensitive information, make sure your password is strong, unique—and not easily guessable.
Only 45% would change a password after a breach
According to the Google survey, fewer than half of Americans say that they would change an online account password if they discovered it had been breached.
What are 4 things to do when you get hacked? ›
10 Things to Do ASAP When You've Been Hacked
- Forewarned Is Forearmed. 1/10. ...
- Recover or Report. 2/10. ...
- Change Your Passwords. 3/10. ...
- Check Your Settings. 4/10. ...
- Protect Your Other Accounts. 5/10. ...
- Notify Your Contacts. 6/10. ...
- Ensure Financial Account Security. 7/10. ...
- Take Action Against Identity Theft. 8/10.
Should I delete my email after it's hacked? No, don't delete your email, even after it's been hacked. This is because most email providers will recycle old and deleted email addresses. If you're concerned, stop using your email for sending or receiving messages, but don't delete it.
What happens if a scammer has your email address? ›
One of the major risks of scammers having your email address is that they'll use it to hack into your other online accounts. With your email address, they can request password resets, try entering your other passwords that have been leaked online, and even break into your email account.
Do you need to report every data breach? ›
When a personal data breach has occurred, you need to establish the likelihood of the risk to people's rights and freedoms. If a risk is likely, you must notify the ICO; if a risk is unlikely, you don't have to report it.
What are the three 3 kinds of data breach? ›
An availability breach resulting from loss, accidental or unlawful destruction of personal data; Integrity breach resulting from alteration of personal data; and/or. A confidentiality breach resulting from the unauthorized disclosure of or access to personal data.
Has LastPass ever been hacked? ›
As reported Wednesday on its blog, LastPass recently detected unusual activity within a third-party cloud storage service. An investigation has so far revealed that the breach stemmed from knowledge gained during the August 2022 incident, and that “certain elements of customers' information” have been accessed.
Can my LastPass account get hacked? ›
LastPass has admitted that hackers have stolen critical customer information, including backups of encrypted password vaults. This puts a large number of customers at risk of getting hacked. If you are a LastPass user, it is time to update all your passwords and account details.
Can hackers hack LastPass? ›
All 30 million LastPass (opens in new tab) users, with data stored on the company servers as of August 2022, are at risk. Hackers now have a copy of your entire password vault. Should they manage to crack your master password, they can take over your online life.
How do I protect LastPass? ›
LastPass Security Features You Should Be Using
- Move Old Passwords to LastPass.
- Run the Security Challenge.
- Turn on Two-Factor Authentication.
- Set Up an Emergency Contact.
- Enable a Security Email Address.
- Link a Personal Account.
Passwords saved on your web browser are prone to hacking. Here's what you can do to keep your data safe. Passwords stored on web browsers can be easily stolen by a malware called Redline Stealer.
How many passwords can I store in LastPass free? ›
We encourage you to do your research to evaluate what solution is best for you, so we've included a few competitor details to get you started. Dashlane is only available on 1 device and for up to 50 passwords, while LastPass is available on unlimited devices of one type (computer or mobile) and unlimited passwords.
Which password is most important to remember for LastPass? ›
The master password is the password that you are prompted to create when you initially sign up for your LastPass account. When you log in to LastPass, you need your email address and master password to access your account. It is very important that you create a very strong master password that you will not forget.
What happens if you lose your phone with LastPass? ›
Select My phone is lost or stolen > Send me a recovery email. Note: Your LastPass account is still protected because it is only accessible through your biometrics. Result: You are sent a passwordless login registration email to pair your LastPass account with your mobile device.
