Although the threat actor did not access customer data in the August incident, some source code and technical information were stolen and used to target another employee. This allowed the threat actor to obtain credentials and keys to access and decrypt storage volumes within the cloud storage service.
According to LastPass, the cloud storage service accessed by the threat actor is physically separate from the production environment. However, the actor copied customer account information, including email addresses, company names, billing addresses, telephone numbers, end-user names, and IP addresses.
The threat actor copied a backup of the production data, including unencrypted data, such as URLs. In addition to the unencrypted data, encrypted sensitive information, like usernames and passwords, secure notes, and form-filled. The data is stored in a proprietary binary format, and the encrypted fields are protected by 256-bit AES encryption. The threat actor can only decrypt them with a unique encryption key. The encryption key is derived from the user's master password via LastPass' Zero Knowledge architecture.
The threat actor may attempt to guess customer master passwords using brute force to decrypt copies of vault data they obtained. LastPass has assured its customers that it would be challenging for them to do so because of the encryption methods used to secure the data. However, LastPass advises customers to remain vigilant against brute force, credential stuffing, or other phishing attacks on accounts associated with their LastPass vaults.
The company has taken several steps to address the issue and provide security for its customers. These include revoking the keys accessed by the threat actor, strengthening internal controls, and implementing additional security measures. Furthermore, the company is working with law enforcement and cybersecurity experts to investigate the issue further.
LastPass recommends that all customers follow best practices when creating and managing strong passwords as a precautionary measure. In addition, LastPass customers should remain vigilant and follow the recommended precautions to ensure the security of their personal information.