Categories: Security

LastPass Breached, Warns Users To Change Master Password

LastPass, a popular password-management website, said late on Monday that attackers have compromised its systems, with data stolen that could allow hackers to guess weak master passwords.

The company said that as a precaution it is prompting all users to change their master passwords.

Third-party passwords stored with LastPass were not affected, the company said. LastPass said it is sending an email to all users informing them of the incident.

The breach was detected on Friday, and LastPass found that email addresses, password reminders, server per user salts and authentication hashes were compromised.

A hash is a string of characters used to store a password in an encoded form that is, in theory, difficult to reverse. Aside from this encoding, LastPass said the hashes are protected by measures such as the addition of a random element, called a “salt”, and with additional encryption.

“This additional strengthening makes it difficult to attack the stolen hashes with any significant speed,” said LastPass chief executive Joe Siegrist in a blog post disclosing the incident. “We are confident that our encryption measures are sufficient to protect the vast majority of users.”

However, attackers now have access to low-cost cloud computing resources capable of performing powerful attacks on such security measures, so that as a precaution the company is prompting all users to change their master password.

Account lockdown

Accounts have been locked down for the time being, meaning that unless they are accessed from a trusted IP address or device, users will be requested to verify their identity, unless they have multifactor authentication enabled.

LastPass said users may be particularly vulnerable to password-guessing attacks if they used a weak password, such as one based on a name or dictionary word, or if they used their LastPass password on another website.

Are you a security pro? Try our quiz!

Matthew Broersma

Matt Broersma is a long standing tech freelance, who has worked for Ziff-Davis, ZDnet and other leading publications

Recent Posts

Apple Sales Rise 6 Percent After Early iPhone 16 Demand

Fourth quarter results beat Wall Street expectations, as overall sales rise 6 percent, but EU…

19 hours ago

X’s Community Notes Fails To Stem US Election Misinformation – Report

Hate speech non-profit that defeated Elon Musk's lawsuit, warns X's Community Notes is failing to…

20 hours ago

Google Fined More Than World’s GDP By Russia

Good luck. Russia demands Google pay a fine worth more than the world's total GDP,…

21 hours ago

Spotify, Paramount Sign Up To Use Google Cloud ARM Chips

Google Cloud signs up Spotify, Paramount Global as early customers of its first ARM-based cloud…

2 days ago

Meta Warns Of Accelerating AI Infrastructure Costs

Facebook parent Meta warns of 'significant acceleration' in expenditures on AI infrastructure as revenue, profits…

2 days ago

AI Helps Boost Microsoft Cloud Revenues By 33 Percent

Microsoft says Azure cloud revenues up 33 percent for September quarter as capital expenditures surge…

2 days ago