LastPass, a leading password manager, disclosed on December 22, 2022, that it has suffered a security incident involving an unauthorized party exfiltrating a backup of customer vault data and other personally identifiable information (PII) through a cloud-based storage service. Karim Toubba, the CEO of LastPass, released a notice explaining that the third-party actors gained access to this service by leveraging information obtained from the company’s security incident that was disclosed in August 2022. In August, actors exfiltrated a portion of the platform’s source code and technical information from a development environment but did not have access to customer data. The August data was used to “target another employee, obtaining credentials and keys which were used to access and decrypt some storage volumes within the cloud-based storage service.” Toubba continued to detail that some of the copied data contains “basic customer account information and related metadata including company names, end-user names, billing addresses, email addresses, telephone numbers, and the IP addresses from which customers were accessing the LastPass service.” The customer vault data that was stolen contains both unencrypted data (such as website URLs) and encrypted sensitive fields (such as website usernames and password, secure notes, and form-filled data), which are secured with 256-bit AES encryption. It is emphasized that the encrypted data can only be decrypted with a unique encryption key derived from each user’s master password, which is “never known to LastPass and is not stored or maintained by LastPass,” using the platform’s Zero Knowledge architecture. Actors that have access to the exfiltrated data may attempt to target LastPass customers with phishing attacks, credential stuffing, or brute force attacks to gain master passwords and decrypt the exposed vault copies. However, users that reuse their master password on other platforms that also use their email address or telephone number are recommended to change all the passwords that are saved in their vaults, as actors may use already available data dumps of compromised credentials to attempt to access users’ accounts. CTIX analysts will continue to monitor this security incident and report on advancements in the next coming weeks when applicable.