Though the most sensitive data is encrypted, the problem is that the threat actor can run 'brute force' attacks on those stolen local files. But if you're a LastPass subscriber, you need to operate under the assumption that your user and vault data are in the hands of an unauthorized party with ill intentions.

The company didn't specify how many users were affected, and LastPass didn't respond to CNET's request for additional comment on the breach. At the very least, you need to change all of the passwords you have stored with LastPass right away if you haven't already. The company has promised to post more updates “as we learn more.Even so, if you're a LastPass subscriber, the severity of this breach should have you looking for a different password manager, because your passwords and personal data can still be at serious risk of being exposed. LastPass has reassured users that its “products and services remain fully functional,” and has recommended customers should follow its best practices for setting up and configuring their accounts using the instructions on the LastPass website. Law enforcement agencies have also been notified, and no doubt will be carrying out their own investigation. In the meantime, LastPass has been working with security firm Mandiant to work out exactly what happened in this latest security breach. LastPass can also be used to safely stow credit card information, private notes, and other data that should be kept locked away from prying eyes.

People store incredibly sensitive information in password managers, and not just the keys to their digital accounts. Still, it’s a worrying development for both LastPass and its users. With that kind of firewalling in place, the hackers were unable to steal any passwords or vital account data. That’s thanks to LastPass’s Zero Knowledge structure, which basically means that only you have access to your master password and any data stored inside your vault - not even LastPass’s developers can access it. Your passwords are safe Andrew Brookes/Getty Imagesįortunately, there is some good news: customer passwords appear to be safe and remain fully encrypted.

Last pass data breach