© 2023 | WUWF Public Media
11000 University Parkway
Pensacola, FL 32514
850 474-2787
NPR for Florida's Great Northwest
Play Live Radio
Next Up:
0:00
0:00
Available On Air Stations

Major password manager LastPass suffered a breach — again

In this photo illustration, the LastPass logo is reflected on the internal discs of a hard drive in 2017 in London. On Wednesday, the password service reported "unusual activity" within a third-party cloud storage service but said that customers' passwords remain safely encrypted.
Leon Neal
/
Getty Images
In this photo illustration, the LastPass logo is reflected on the internal discs of a hard drive in 2017 in London. On Wednesday, the password service reported "unusual activity" within a third-party cloud storage service but said that customers' passwords remain safely encrypted.

LastPass, a major password manager, says it has suffered its second breach in three months by the same unauthorized party.

LastPass CEO Karim Toubba announced Wednesday that the company detected "unusual activity" within a third-party cloud storage service but that customers' passwords remain safely encrypted.

"We immediately launched an investigation, engaged Mandiant, a leading security firm, and alerted law enforcement," Toubba wrote in a statement.

An unauthorized party gained access to parts of the LastPass development environment during a four-day period in August. There was no evidence of access to customer data, Toubba wrote after this first breach, noting that the development environment does not contain any customer data.

Three months later, the same party used the information it gained in August to access "certain elements" of customers' information, Toubba said.

Toubba maintains that passwords are safely encrypted despite the recent breach.

"We are working diligently to understand the scope of the incident and identify what specific information has been accessed," Toubba said. "In the meantime, we can confirm that LastPass products and services remain fully functional."

Still, the company recommended that its users "follow our best practices around setup and configuration," including setting up multi-factor authentication.

Wired named LastPass one of its honorable mentions for password managers this year. Previously, it was the tech publication's favorite free option before LastPass changed its free plan to limit users to a single device.

"Lastpass' paid plan offers most of the same features you'll find in our other top picks, though it lacks the travel features of 1Password and isn't open source like BitWarden," Wired wrote. "We just don't see any reason to suggest it over our top picks, and it was recently hacked."

Copyright 2022 NPR. To see more, visit https://www.npr.org.

Tags
Ashley Ahn
Ashley Ahn is an intern for the Digital News and Graphics desks. She previously covered the rollout of COVID-19 vaccines for CNN's health and medical unit and the trial of Ahmaud Arbery's killers for CNN's Atlanta News Bureau. She also wrote pieces for USA TODAY and served as the Executive Editor of her college's student newspaper, The Daily Pennsylvanian. Recently graduated from the University of Pennsylvania, Ahn is pursuing a master's degree in computer science at Columbia University.