LastPass was hacked for the second time this year

Password management app LastPass says it is investigating a security incident after an “unauthorized party” compromised its systems and gained access to some customer information on Wednesday.

The information was stored in a third-party cloud service shared by LastPass and parent company GoTo, LastPass CEO Karim Toubba said in a blog post. Toubba said hackers used information stolen from LastPass systems in a separate previously disclosed incident that occurred in August of this year. Toubba added in a blog post that “customer passwords remain securely encrypted.”

We recently noticed unusual activity within a third-party cloud storage service currently shared by both LastPass and its affiliate GoTo. We immediately launched an investigation, engaged Mandiant, a leading security firm, and alerted the police.

We have determined that an unauthorized party may have gained access to certain elements of our customers’ information using information obtained in the August 2022 incident. Our customers’ passwords stay securely encrypted thanks to the LastPass Zero Knowledge architecture.

According to a blog post on August 22, a previous incident saw a threat actor gain access to the LastPass development environment using a compromised developer endpoint to steal source code and some proprietary LastPass technical information. LastPass said at the time that its systems “prevented a threat actor from accessing any customer data or encrypted password vaults.”

LastPass is currently working to understand the scope of Wednesday’s incident and determine what specific information was exposed. GoTo, formerly LogMeIn, said it was also investigating the incident, though it did not say whether GoTo users were also affected by the hack. In the meantime, LastPass products and services remain “fully functional,” Toubba said.