The threat actor was also able to copy a backup of customer vault data from the encrypted storage container which is stored in a proprietary binary format that contains both unencrypted data, such as website URLs, as well as fully-encrypted sensitive fields such as website usernames and passwords, secure notes, and form-filled data. …To date, we have determined that once the cloud storage access key and dual storage container decryption keys were obtained, the threat actor copied information from backup that contained basic customer account information and related metadata including company names, end-user names, billing addresses, email addresses, telephone numbers, and the IP addresses from which customers were accessing the LastPass service. LastPass suffers another data breach, says customer data was stolen As always, we recommend that you follow our best practices around setup and configuration of LastPass, which can be found here. In the meantime, we can confirm that LastPass products and services remain fully functional. We are working diligently to understand the scope of the incident and identify what specific information has been accessed. Our customers’ passwords remain safely encrypted due to LastPass’s Zero Knowledge architecture. We have determined that an unauthorized party, using information obtained in the August 2022 incident, was able to gain access to certain elements of our customers’ information.

We immediately launched an investigation, engaged Mandiant, a leading security firm, and alerted law enforcement.

We recently detected unusual activity within a third-party cloud storage service, which is currently shared by both LastPass and its affiliate, GoTo. In keeping with our commitment to transparency, I wanted to inform you of a security incident that our team is currently investigating. Update as of Wednesday, November 30, 2022

Lastpass premium crack