Password Management Program LastPass Breached

LastPast, one of the leading password management programs, just announced that it has been hacked. The data breach may have compromised master passwords and security questions. So the critical thing for users to do immediately is to change their master passwords and ensure they are taking advantage of multifactor authentication.

"Our team discovered and blocked suspicious activity on our network," says Joe Siegrist, LastPass CEO, "in our investigation, we have found no evidence that encrypted user vault data was taken, nor that LastPass user accounts were accessed. The investigation has shown, however, that LastPass account email address, password reminders, server per user salts, and authentication hashes were compromised."

The recent breach was discovered on June 12th and it has a familiar ring to their last breach reported back in 2011. The firm did take a number of steps to tighten security after the 2011 breach, but still found themselves in the same place.

The good news, if there is any, is that the company is stating that they are "confident that our encryption measures are sufficient to protect the vast majority of users with any significant speed." This is due to the way LastPass hashes their encrypted data, but because there is a possibility of compromise, they have "locked down" all accounts. All users must verify their identity via email unless they're already using multifactor authentication.

Using email to verify identification can be risky as this may lead to phishing attacks on everyone, not just users of LastPass. Keep in mind that any major story in the news is a likely target to phishing attacks. One should be very cautious when clicking on email links or opening email attachments. Phishing emails can look identical to the real thing and can fool even the experts.