LastPass recommends that customers reset their master password and enable multi-factor authentication.The investigation reveals that the data accessed included on-demand, cloud-based development and source code repositories, internal scripts, internal documentation, DevOps secrets, cloud-based backup storage, backups of all customer vault data (encrypted), and backup of LastPass multi-factor authentication/Federation Database.These actions include analyzing cloud-based storage resources, applying additional policies and controls, changing existing privileged access controls, and rotating relevant secrets and certificates. In response, LastPass has taken several actions to secure its systems and customer data.The threat actor stole source code, technical information, internal LastPass secrets, and both encrypted and unencrypted customer data. The threat actor accessed non-production development and backup storage environments.Instead, a vulnerability in third-party software was exploited. The investigation indicates that the incident was not caused by a defect in any LastPass product or unauthorized access to production systems.The investigation into the LastPass security incidents has been completed, and no threat-actor activity has been discovered since October 26, 2022.Some key points of the LastPass release are: It is important, though, that users follow the advice of vendors and stay aware of changes in security guidance. However, when password managers are used as part of layered security, they can be an effective control.

These incidents highlight the fact that no one security measure can be 100% effective.

LastPass’s March 1, 2023 press release provides an update on the 2022 security incidents, the results of their investigations, and recommended remediation actions.

Cyber-RISK: FFIEC Cybersecurity Assessment.

Lastpass security