INCIDENT: Cyberattack at Global Password Management Firm, LastPass, Compromises Users’ Master Passwords

Many LastPass users report that their master passwords have been compromised after receiving email warnings that someone tried to use them to log into their accounts from unknown locations. The email notifications also mention that the login attempts have been blocked because they were made from unfamiliar locations worldwide. "Someone just used your master password to try to log in to your account from a device or location we didn't recognize," the login alerts warn. LastPass says it's credential stuffing.

While LastPass didn't share any details regarding how the threat actors behind these credential stuffing attempts, security researchers Bob Diachenko said he recently found thousands of LastPass credentials while going through Redline Stealer malware logs. Two years ago, in September 2019, LastPass fixed a security vulnerability in the password manager's Chrome extension that could have allowed threat actors to steal the credentials last used for logging into a site, according to Bleepingcomputer.

Incident Date

December 28, 2021

Location

Estimated Cost

unknown

Victims

Type of Malware:

No Malware identified

Threat Source:

No threat source identified

References:

  • LastPass users warned their master passwords are compromised

Industries:

Impacts

IT

Pin It on Pinterest

Scroll to Top