However, even if your master password is strong enough that a brute-force attack with today’s technologies would take centuries, this may change with quantum computers. This can take anywhere between days to centuries, depending on the strength of your master password and how much compute power these bad actors throw at the problem. Encryptions can be broken with brute-force attacks (trying out all possible password combinations). Second, the only thing standing between the bad actors and all of your usernames and passwords that you had stored in your LastPass vault is the data encryption. With that, they can target you with phishing attacks (Contacting you and pretending to be Amazon, for example) or credential stuffing attacks (trying passwords from other, existing data breaches to get into your online accounts). If you paid for LastPass Premium, they probably have your physical address as well. What does that mean?įirst, if you’re a LastPass user, bad actors now have access to your Email address as well as all of the URLs you had stored inside your LastPass vault. encrypted user name and passwords for those logins.įor whatever reason, LastPass didn’t reveal the exact number of their 30 Million users users that were impacted, nor the exact date of the data breach.

the website URLs (unencrypted!) for logins stored in their vault, and.

their billing addresses (if they paid for premium services),.

Armed with the credentials, they stole personal data from LastPass users, including They then used that information to attack an employee’s machine directly, and obtained access credentials to the LastPass data server.

What happened?īack in August 2022, a group of hackers gained access to one of LastPass’s dev environments and stole source code and technical information. If one wanted to bury bad news, there may be no better way to do it. The link greets me with a pop-up window, asking me cheerily to subscribe for future updates. LastPass has an ‘update’ on a recent security ‘incident’, and asks me to click the link to their blog to learn more. The Email arrived at 6am on Friday before the Christmas weekend.

My last pass vault