In a disturbing move, GoTo hid its own disclosure from search engines. First, the attacker had targeted one LastPass developer and then another to break deeper into LastPass’s systems, including the cloud storage of LastPass’s parent company, GoTo.
LastPass eventually made it clear the attacker stole some customer data in a second breach enabled by “information obtained” in the earlier breach. Starting in late November, Toubba made several more updates to LastPass’s disclosure that Zack Whittaker at TechCrunch helpfully parsed to show what LastPass was not explaining. We believed our critical account information was totally secure, untouched by intruders. Unequivocally, he assured LastPass customers their master passwords, data, and personal information were safe. The initial disclosure said “an unauthorized party” partially accessed LastPass engineers’ development environment by exploiting “a single compromised developer account.” The intruder stole some source code and “proprietary LastPass technical information.” However, Toubba said there was no impact on the LastPass password management platform itself or its customers. In August 2022, LastPass CEO Karim Toubba posted the first of what would become a series of increasingly serious public disclosures about a deep and ongoing security breach.
We believed our critical account information was totally secure. Unequivocally, LastPass assured customers their master passwords, data, and personal information were safe. Let’s take a look at what happened, what should have happened, and how you should proactively secure your online accounts. Finally, if you’re responsible for the security of others’ data or if you have a communication role, you can learn from LastPass’s mistakes - mainly what not to do. Even better, start using passkeys when possible - they make passwordless logins the ultimate security solution. After a massive security breach at LastPass the company did not disclose in a timely manner - which has put potentially your data at risk - you should look into switching to Bitwarden or 1Password.
If you’re a LastPass user, like many of us in the WordPress community, you may be looking for an alternative password management solution today. What You Need to Know and Do About the LastPass Breach
0 kommentar(er)
