scapesvur.blogg.se

In addition, user password vaults were stolen containing unencrypted website URLs and site names as well as encrypted usernames and passwords.

December 2022: LastPass disclosed that criminals used some of the information obtained in the earlier breach to steal backup data, including customer names, addresses, phone numbers, email addresses, IP addresses, and partial credit card numbers.Apparently, these keys were not changed immediately after the initial breach was identified, which may have prevented access to the cloud storage. It was determined that an unauthorized party, using the cloud storage access key and container decryption keys obtained in the August 2022 incident, was able to gain access to certain elements of our customers’ information.LastPass immediately launched an investigation, engaged Mandiant, a leading security firm, and alerted law enforcement.November 2022: LastPass detected unusual activity within a third-party cloud storage service, which is currently shared by both LastPass and its affiliate.There was no evidence that this incident involved any access to customer data or encrypted password vaults.There was no evidence of any threat actor activity beyond the established timeline.During this timeframe, the LastPass security team detected the threat actor’s activity and then contained the incident.The forensic investigation revealed that the threat actor’s activity was limited to a four-day period in August 2022.