LastPass Data Breach

On December 22, 2022 LastPass disclosed that an attacker used information from an August 2022 incident to target an employee in November 2022, obtaining credentials and keys to copy cloud storage volumes and a backup of customer vault data; exfiltrated material included customer account metadata (company names, user names, billing addresses, emails, phone numbers, IPs), unencrypted website URLs, and a backup containing both encrypted secrets and some unencrypted data, and a limited set of API authentication keys. LastPass states encrypted vault data remains protected by users' master passwords; the report warns of likely targeted phishing and recommends deleting impacted SAML integrations, providing user awareness training, and resetting weak or reused master passwords.