Norton Password Manager Breached

Norton LifeLock customers have been the victim of a credential-stuffing attack. Threat actors have used a third-party list of stolen username and password combinations to attempt and break into Norton password managers.

Data-breach notifications have been sent to customers, noting that it picked up on the activity on Dec. 12, when its IDS systems flagged “an unusually high number of failed logins” on Norton accounts. After a 10-day investigation, it turns out that the activity stretched back to Dec. 1, 2022. But the quantity of compromised accounts was unknown

The notification added, that “we cannot rule out that the unauthorized third party also obtained details stored in the Norton Password Manager, especially if your Password Manager key is identical or very similar to your Norton account password.” Though its strong passwords been generated by the password manager which is widely used on various sites and apps.

Attackers have shifted the focuse on identity and access management systems as a target, given that one compromise can unlock a treasure trove of data across high-value accounts for attackers, not to mention a bevy of enterprise pivot points for moving deeper into networks.

Last year, LastPass was breached twice, and another password manager Okta was breached