While the method used for the initial endpoint compromise is inconclusive, the threat actor utilized their persistent access to impersonate the developer once the developer had successfully authenticated using multi-factor authentication.

He threat actor gained access to the Development environment using a developer’s compromised endpoint. N unauthorized party gained access to portions of the LastPass development environment through a single compromised developer account.Ī follow-up announcement about a month later was similarly inconclusive: The second, Security Challenge, will audit your vault for weak, old, and duplicate passwords as well as any for sites known to have been compromised.Popular password management company LastPass has been under the pump this year, following a network intrusion back in August 2022.ĭetails of how the attackers first got in are still scarce, with LastPass’s first official comment cautiously stating that: Instead of manually logging in to an account and changing the password manually, LastPass will do it with the click of a button for 80 popular sites including Facebook and Amazon. LastPass offers two tools to simplify this. Changing your passwords every so often as a precautionary measure can strengthen your security. The password generator icon appears in the login fields whenever you’re creating a new account or you can access it anytime from your vault or the browse plugin.īut passwords are not a set-it-and-forget-it deal.

There’s also an option to make the password pronounceable for easier recall. LastPass dramatically eases this burden with a powerful password generator that auto-creates up to 12-character passwords using upper- and lower-case letters, numerals, and special characters. LastPass displays all your login accounts as tiles in its virtual vault.Ĭoming up with unique, complex passwords is one of the biggest obstacles to practicing good security.

Lastpass vault