12-24-2022 , 04:17 PM
Quote:Password management service LastPass announced today that the disclosed password breach of August 2022 was more serious than it thought initially. The update confirms that user vault data and personal information was obtained by the threat actor.
The attacker used the obtained data for another attack. LastPass confirmed that it suffered another data breach of a third-party cloud storage that is shared with its former parent company GoTo. User information were obtained by the attacker, but attackers did not access user vaults according to LastPass' initial message regarding the incident.
User data is at risk
The attacker managed to obtain a treasure trove of information during the hack. Not only did they manage to obtain customer data, such as names, phone numbers and email addresses, they also managed to obtain customer vault data. While most of the vault data is encrypted, all that stands between access is the master password.
A weak master password is broken easily with brute force attempts. LastPass' best practices regarding master password use may protect customer data against brute force attacks, as it recommends passwords with at least 12 characters and a mix of numbers, letters and special characters.
Continue reading HERE