June 5, 2023

LastPass suffered in a data breach in August that enabled a hacker to infiltrate the company again and steal customer information.

LastPass announced yesterday that it was investigating the breach, which involved a third-party cloud storage service connected to company systems.

LastPass has said customers’ passwords should remain safe since the company doesn’t store information on the “Master Password” customers use to access the encrypted password vaults over the platform.


The incident shows the August breach at LastPass was more serious than initially thought. At the time, the company said the August breach only ensnared its internal systems for software development, not any data concerning customer passwords.

The hacker was able to steal portions of company source code and some proprietary LastPass technical information, which likely paved the way for the follow-up intrusion.

In September, LastPass also said it had concluded its investigation into the breach with the help of cybersecurity firm Mandiant. The results found the hacker only had access to the internal systems for four days. No evidence was found of any tampering either. But it seems LastPass still failed to uncover all the potential ways the hacker could use the access to breach the company again.

LastPass didn’t name the third-party cloud storage service the hacker used to breach the company for a second time. But LastPass has been sharing the cloud storage service with its affiliate GoTo. Both companies are currently owned by private equity firms.


In response to the new breach, LastPass has deployed additional security measures and monitoring of the company’s IT infrastructure. It’s also contacted Mandiant and law enforcement about investigating the hack.

Leave a Reply

%d bloggers like this: