#Lastpass news password#

This chatter indicates an uptick in credential stuffing attacks targeting LastPass accounts, but there doesn’t seem to be any evidence of account breaches or compromise. Many other LastPass users replied to the post on HN and stated that they were experiencing similar activity, and that soon began to echo on Reddit, Twitter, and elsewhere.

But, at least some of these attempts were blocked by LastPass’ security tools, and the account was otherwise protected by two-factor authentication (2FA).

#Lastpass news password#

In this case, attackers seemed to have obtained the account’s master password (probably from a leaked password database that has nothing to do with LastPass). According to most of the media coverage, this was first reported on ycombinator’s Hacker News (HN) forum. Some LastPass accounts became targets of credential stuffing attacks. So, we wrote this blog to summarize what happened, what you should do if you’re a LastPass user, and what any organization can do to detect and respond to credential stuffing attacks. Inflammatory headlines, new articles citing concerns over LastPass’ use of embedded trackers from earlier this year (which is a genuine privacy concern, but unrelated to potential LastPass compromise) and Tweets like this one don’t really help: Some misinformation seems to be spreading, and we’ve had clients ask us if LastPass was breached or if LastPass was exploited. While there seems to have been a recent uptick in credential stuffing attacks targeting LastPass accounts, there doesn’t seem to be any evidence of anything having been breached or compromised – other than LastPass master passwords used in the attacks, which were already compromised. And, if you use a password manager and don’t follow vendor recommendations and best-practices (like using multi-factor authentication), your password manager will probably get hacked.

If you lack basic password hygiene (like using strong passwords, changing them on occasion, and never re-using them), your password has probably already been cracked, leaked, or stolen. No surprise here – according to the latest Verizon Data Breach Investigations Report (DBIR), today’s hackers have a preference for stealing credentials over more complex attacks, so password manager accounts are obvious targets for credential stuffing attacks. On Tuesday, December 28, tech media outlets began reporting ‘ LastPass master passwords may have been compromised ’ or ‘ Hackers are going after LastPass master passwords ’.