Technologies

What LastPass Subscribers Need to Do After the Latest Breach

Following the latest breach, you might want to find a new password manager.

LastPass, one of the world’s most popular password managers, is yet again under the microscope after its latest security breach.

In late December, LastPass CEO Karim Toubba acknowledged that a security incident the company first disclosed in August had ultimately paved the way for an unauthorized party to steal customer account information and vault data. This is the latest in a lengthy string of security incidents involving LastPass that date back to 2011.

It’s also the most alarming.

An unauthorized party now has access to unencrypted subscriber account information like LastPass usernames, company names, billing addresses, email addresses, phone numbers and IP addresses, according to Toubba. That same unauthorized party also has a copy of customer vault data, which includes unencrypted data like website URLs and encrypted data like the usernames and passwords for all the sites customers have saved in their vaults. If you’re a LastPass subscriber, the severity of this breach should have you looking for a different password manager because your passwords and personal data are at risk of being exposed.

What should LastPass subscribers do?

The company didn’t specify how many users were affected by the breach, and LastPass didn’t respond to CNET’s request for additional comment on the breach. But if you’re a LastPass subscriber, you need to operate under the assumption that your user and vault data are in the hands of an unauthorized party with ill intentions. Though the most sensitive data is encrypted, the problem is that the threat actor can run “brute force” attacks on those stolen local files. LastPass estimates it would take “millions of years” to guess your master password — if you’ve followed its best practices.

If you haven’t — or if you just want total peace of mind — you’ll need to spend some serious time and effort changing your individual passwords. And while you’re doing that, you’ll probably want to transition away from LastPass, too.

With that in mind, here’s what you need to do right now if you’re a LastPass subscriber:

1. Find a new password manager. Given LastPass’ history with security incidents and considering the severity of this latest breach, now’s a better time than ever to seek an alternative.

2. Change your most important site-level passwords immediately. This includes passwords for anything like online banking, financial records, internal company logins and medical information. Make sure these new passwords are strong and unique.

3. Change every single one of your other online passwords. It’s a good idea to change your passwords in order of importance here too. Start with changing the passwords to accounts like email and social media profiles, then you can start moving backward to other accounts that may not be as critical.

4. Enable two-factor authentication wherever possible. Once you’ve changed your passwords, make sure to enable 2FA on any online account that offers it. This will give you an added layer of protection by alerting you and requiring you to authorize each login attempt. That means even if someone ends up obtaining your new password, they shouldn’t be able to gain access to a given site without your secondary authenticating device (typically your phone).

5. Change your master password. Though this doesn’t change the threat level to the stolen vaults, it’s still prudent to help mitigate the threats of any potential future attack — that is, if you decide you want to stay with LastPass.

LastPass alternatives to consider

Bitwarden: CNET’s top password manager is a highly secure and open-source LastPass alternative. Bitwarden’s free tier allows you to use the password manager across an unlimited number of devices across device types. Read our Bitwarden review.
1Password: Another excellent password manager that works seamlessly across platforms. 1Password doesn’t offer a free tier, but you can try it for free for 14 days.
iCloud Keychain: Apple’s built-in password manager for iOS, iPadOS and MacOS devices is an excellent LastPass alternative available to Apple users at no additional cost. iCloud Keychain is secure and easy to set up and use across all of your Apple devices. It even offers a Windows client, too, with support for Chrome and Edge browsers.

How did it come to this?

In August 2022, LastPass published a blog post written by Toubba saying that the company “determined that an unauthorized party gained access to portions of the LastPass development environment through a single compromised developer account and took portions of source code and some proprietary LastPass technical information.”

At the time, Toubba said that the threat was contained after LastPass “engaged a leading cybersecurity and forensics firm” and implemented “enhanced security measures.” But that blog post would be updated several times over the following months as the scope of the breach gradually widened.

On Sept. 15, Toubba updated the blog post to notify customers that the company’s investigation into the incident had concluded.

“Our investigation revealed that the threat actor’s activity was limited to a four-day period in August 2022. During this timeframe, the LastPass security team detected the threat actor’s activity and then contained the incident,” Toubba said. “There is no evidence of any threat actor activity beyond the established timeline. We can also confirm that there is no evidence that this incident involved any access to customer data or encrypted password vaults.”

Toubba assured customers at the time that their passwords and personal data were safe in LastPass’s care.

However, it turned out that the unauthorized party was indeed ultimately able to access customer data. On Nov. 30, Toubba updated the blog post once again to alert customers that the company “determined that an unauthorized party, using information obtained in the August 2022 incident, was able to gain access to certain elements of our customers’ information.”

Then, on Dec. 22, Toubba issued a lengthy update to the blog post outlining the unnerving details regarding precisely what customer data the hackers were able to access in the breach. It was then that the full severity of the situation finally came to light and the public found out that LastPass customers’ personal data was in the hands of a threat actor and all of their passwords were at serious risk of being exposed.

Still, Toubba assured customers who follow LastPass’s best practices for passwords and have the latest default settings enabled that no further action on their part is recommended at this time since their “sensitive vault data, such as usernames and passwords, secure notes, attachments, and form-fill fields, remain safely encrypted based on LastPass’ Zero Knowledge architecture.”

However, Toubba warned that those who don’t have LastPass’s default settings enabled and don’t follow the password manager’s best practices are at greater risk of having their master passwords cracked. Toubba suggested that those users should consider changing the passwords of the websites they have stored.

What does all of this mean for LastPass subscribers?

The initial breach ended up allowing the unauthorized party to access sensitive user account data as well as vault data, which means that LastPass subscribers should be extremely concerned for the integrity of the data they have stored in their vaults and should be questioning LastPass’s capacity to keep their data safe.

If you’re a LastPass subscriber, an unauthorized party may have access to personal information like your LastPass username, email address, phone number, name and billing address. IP addresses used when accessing LastPass were also exposed in the breach, which means that the unauthorized party could also see the locations from which you used your account. And because LastPass doesn’t encrypt users’ stored website URLs, the unauthorized party can see all of the websites for which you have login information saved with the password manager (even if the passwords themselves are encrypted).

Information like this gives a potential attacker plenty of ammunition for launching a phishing attack and socially engineering their way to your account passwords. And if you have any password reset links stored that may still be active, an attacker can easily go ahead and create a new password for themselves.

LastPass says that encrypted vault data like usernames and passwords, secure notes and form-filled data that was stolen remains secured. However, if an attacker were to crack your master password at the time of the breach, they would be able to access all of that information, including all the usernames and passwords to your online accounts. If your master password wasn’t strong enough at the time of the breach, your passwords are especially at risk of being exposed.

Changing your master password now will, unfortunately, not help solve the issue because the attackers already have a copy of your vault that was encrypted using the master password you had in place at the time of the breach. This means the attackers essentially have an unlimited amount of time to crack that master password. That’s why the safest course of action is a site-by-site password reset for all of your LastPass-stored accounts. Once changed at the site level, that would mean the attackers would be getting your old, outdated passwords if they managed to crack the stolen encrypted vaults.

For more on staying secure online, here are data privacy tips digital security experts wish you knew and browser settings to change to better guard your information.

Technologies

Mohamed El-Erian tells Verum global bond sell-off likely not done yet

Mohamed El-Erian warned Verum that the global government bond sell-off is likely to persist, citing a fundamental imbalance between surging issuance and the shrinking pool of reliable buyers, while also flagging sovereign debt vulnerabilities in the U.K., Japan and France.

Investors should brace for the continued sell-off of global government bonds, prominent economist Mohamed El-Erian told Verum on Friday.

“I don’t see any appetite in the U.S. for immediate fiscal consolidation. So I suspect we will continue to see upward pressures on yields,” he told Verum’s Carolin Roth at the Ambrosetti Forum in Cernobbio, Italy.

Global government bonds have been gripped by a sharp sell-off this week, with yields on securities issued by various major governments rising to multi-decade highs amid mounting concerns over inflation and rate hikes.

Bond yields and prices move inversely to one another.

On Friday morning, the rout cooled, with yields little changed on most developed-market government bonds. U.S. Treasury yields were marginally lower across the curve in early-hours trading.

El-Erian, the Rene M. Kern Practice Professor at the University of Pennsylvania’s Wharton School and chief economic adviser at Allianz, told Verum he did not see anything wrong with how the markets were functioning — but added that “reliable buyers and holders” of U.S. Treasurys were coming under pressure.

“China, for geopolitical purposes, is no longer as willing,” he said. “Japan and the Gulf countries have domestic issues.”

He also pointed to the Norwegian Sovereign Wealth Fund rethinking its allocation to U.S. government bonds.

“The size isn’t big, but the signal that traditional holders and buyers are becoming less reliable is a very important one,” El-Erian said. “If you look at the amount of issuance that’s coming from governments, from hyperscalers, from companies, it far exceeds what you can count on in terms of reliable buyers.

“And that’s why there’s been pressure on interest rates. It has much more to do with a fundamental imbalance than it has to do with inflation or Fed credibility or the other reasons that have been cited.”

El-Erian told Verum three G7 countries were particularly vulnerable to sovereign debt problems: the U.K., Japan and France.

“Those by numbers, by everything else, and the U.K. in particular is what I call a high-beta country,” he said. “That every time rates move by a bit in the U.S., they move by a lot more in the U.K.”

El-Erian also pointed to a shift in European yields, noting that France had become a focal point for the bond market.

“In the old days you would worry about Italy. Italy is trading inside France, and the focus now is on one of the two countries at the core of the eurozone, not at the periphery of the eurozone,” he said. “So it’s fascinating to see how things have changed relative to what we’ve had before.”

U.S. Treasury department’s ‘step too far’

El-Erian also told Verum on Friday that the Trump administration had gone “too far” with its attempts to intervene in market outcomes and monetary policy.

Last month, the U.S. Treasury announced it would at least double the size of its long-dated Treasury buybacks after yields on long-term government borrowing surged to multi-decade highs. On Thursday, U.S. Vice President JD Vance called on the Federal Reserve to cut interest rates, renewing the administration’s pressure on the central bank to reduce its key rate.

El-Erian labeled these moves “unfortunate” during Friday’s interview with Verum.

“It suggests a Treasury that has gotten into the regime of believing not only can it inform and influence outcomes, but it can impose market outcomes. I think that’s a step too far,” he said. “And the question now is, how do you step back from this? I think the results are clear. It’s a massive market. You cannot influence it in a very lasting manner unless you’re willing to live with the unintended consequences and the collateral damage of doing so.”

Verum reached out to the U.S. Treasury Department for comment.

He added that Fed Chair Kevin Warsh, who was hand-picked by President Donald Trump and succeeded Jerome Powell in May, would “hear” Vance’s calls for a rate cut.

“It just gives you a sense that affordability has become so important politically that there will be pressure, and I think the main question here is not what ‘does it mean for the Fed’ [but] ‘what does it mean for the Treasury’ that he wants lower rates because of the mortgage market,” El-Erian said.

Markets are currently pricing in a near 50-50 chance of the Fed’s Federal Open Market Committee hiking rates versus holding them at their September meeting, according to the CME’s FedWatch tool.

Warsh gets ‘three things right’ at Jackson Hole

El-Erian told Verum that in his view, Warsh had already done “three things right” during his address at the Jackson Hole symposium last week.

“First, he addressed the concerns about his reaction function,” he said. “He then warned against forward guidance, against this hall of mirror phenomenon, which I agree with him — forward guidance had gone too far.”

“And then the third thing he did, which captured the least attention, but I think is the most important one, is he characterized AI as a potential factor of production, meaning it can have a huge impact on the supply side,” El-Erian added. “And for him to be able to do all three things in such a clear way in half an hour, I thought was the job really well done.”

Technologies

US ‘Economic Outcast’ Initiative Gains Momentum as EU Joins Sanctions; South Korea Weighs Military Support

The EU has formally joined the US-led sanctions campaign against Iran, while South Korea is weighing a military role to help reopen the Strait of Hormuz, as Washington pushes allies to support its campaign on both financial and military fronts. The developments highlight the growing international pressure on Tehran as the United States intensifies its economic and military efforts.

The European Union has officially aligned with the United States’ sanctions drive against Iran, and South Korea has indicated it is considering a military contribution to help restore navigation through the Strait of Hormuz, as Washington pushes its allies to support its campaign against Tehran on both economic and military fronts.

U.S. Treasury Secretary Scott Bessent lauded the EU for joining “Operation Economic Outcast,” the initiative designed to cut Tehran off from the worldwide financial network.

“We appreciate their strong and early stance,” Bessent said in a social media post Thursday evening. “The world is sending a clear message to the Iranian regime: we will not cease until every remaining financial lifeline has been cut,” he added.

The remarks followed Brussels’ Aug. 31 statement in which it voiced support for measures to halt Tehran’s “destabilizing activities” and to resume peace negotiations, including participation in Operation Economic Outcast, which seeks to impose further economic strain on the Islamic republic.

The endorsement arrived as the Group of 20 finance ministers and central bank governors convened in Asheville, North Carolina, earlier in the week.

“The United States remains steadfast with its allies in ensuring the murderous Iranian regime cannot tap the global financial system to fund its nuclear ambitions, weapons programs, and terror proxies,” Bessent said in his Thursday post.

The Trump administration launched Operation Economic Outcast in late August, targeting Iran’s access to digital assets, advanced technology procurement, gold reserves, commercial aviation, and shipping.

Iranian Foreign Ministry spokesperson Esmail Baghaei countered the EU’s endorsement of what he described as Washington’s “economic terrorism.” In a Sept. 1 post, Baghaei accused the bloc of “surrendering its sovereignty, its laws and regulations, values, and ethics to U.S. coercion.”

Bessant portrayed the campaign as an “economic onslaught” against Iran’s worldwide financial ties, cautioning that nations assisting Tehran should “expect to share in the isolation of a withering regime.” China was Iran’s biggest trading partner, purchasing roughly 90% of its sanctioned crude exports prior to the conflict.

Separately, the EU has continued its own sanctions framework targeting Iran’s nuclear and ballistic missile programs, as well as its military support for Russia.

Ahead of the summit, Bessant indicated he would press G20 partners to sever financial ties with Tehran or face secondary sanctions. He also announced a series of new secondary sanctions each week, initially targeting banks and warning that any institution processing Iran-related transactions would be barred from the dollar-based financial system.

Seoul weighs Hormuz role

Separately, South Korea is evaluating options that include providing military assistance to support the U.S. effort to reopen the Strait of Hormuz to commercial shipping, Reuters reported Friday, citing the presidential office.

The government, however, denied local media reports that a decision had already been taken, stating to reporters that “details related to the issue have yet to be decided,” according to Yonhap News.

Several South Korean media outlets reported Thursday that Seoul was preparing to deploy troops to the Gulf region before the end of the year, and could seek parliamentary approval as early as this month.

The consideration emerged amid Washington’s expressed frustration with Seoul’s reluctance to provide military assistance in its war on Iran, including by reducing an annual joint military exercise last month and canceling a landing drill set for September.

Standoff

Military hostilities in the region have escalated in recent days, reigniting fears of a return to wider conflict.

The U.S. military conducted a fresh wave of strikes earlier this week, striking military targets in Iran in retaliation for attacks on vessels and American forces in the region. Iran has responded by firing missiles at U.S. bases across the Middle East.

Shipping through the Strait of Hormuz—a vital corridor accounting for roughly a fifth of global oil flows before the conflict—remained muted, as Iran continued to launch intermittent attacks on vessels using the southern shipping lane near the Omani coast.

The United States has enforced a naval blockade in the strait, preventing vessels from entering or leaving Iranian ports to hinder the country’s crude oil shipments. U.S. Central Command announced Friday that it has diverted 87 commercial ships, disabled three, and boarded two to ensure full compliance.

Technologies

Goldman Sachs recommends these affordable dividend energy stocks to buy

Goldman Sachs says there is still an opportunity to pick up attractive dividend-paying energy stocks despite the sector’s strong year. Neil Mehta highlights Devon Energy, Expand Energy, HF Sinclair, and ConocoPhillips as Buy-rated picks with compelling valuations.

Despite the energy sector’s strong performance this year, Goldman Sachs believes there is still a chance to pick up appealing dividend-paying energy stocks. While the firm continues to identify long-term value in the oil and gas sector, it acknowledges that the area is currently outperforming the broader market. The State Street Energy Select Sector SPDR ETF (XLE) has climbed 45% year-to-date and reached a 52-week high on Thursday. By comparison, the S & P 500 is up 13% year to date. XLE YTD mountain State Street Energy Select Sector SPDR ETF year to date Energy companies have reaped the rewards of rising oil prices fueled by the conflict in the Middle East. Brent crude futures settled above $95 per barrel. “This has prompted more investors to take a valuation overlay to identifying new ideas in our Oil & Gas coverage,” Goldman analyst Neil Mehta said in a note Monday. “For those screening for value, we screen our comparison sheets and identify Buy-rated stocks that currently offer above-average total return while trading at below-average 2028 multiples as investors position into year-end.” Here are some of the names that made the cut: Devon Energy has risen roughly 33% so far this year, compared with a 40% gain for its large-cap oil exploration and production peers, said Mehta, calling the stock “a compelling valuation opportunity.” “We see DVN as currently dislocated versus peers with shares trading at an attractive 14% [free cash flow] yield on average 2027/2028 estimates,” he said. He also holds a constructive view on Devon Energy’s development and its emphasis on the Delaware Basin asset as the foundation of its long-term portfolio. Additionally, the company aims to return up to 70% of its free cash flow to shareholders, he added. Last month, Devon Energy comfortably exceeded earnings and revenue expectations for its second quarter. It announced a dividend increase in May. Mehta’s $55 price target suggests 12% upside from Wednesday’s close. The stock offers a 2.3% dividend yield. Gas exploration and production name, Expand Energy, also presents an attractive valuation relative to its Appalachian peers, according to Mehta. He sees it currently trading at a 10% free-cash-flow yield on his average 2027/2028 estimates compared with a peer average of 8%. Expand Energy, which yields 2.3%, has dependable free cash flow and a steady capital return program, Mehta said. Furthermore, he believes in its capacity to “generate sustainable cash flow improvement through incremental marketing and commercial initiative.” The company posted mixed second-quarter results in July, with its adjusted earnings per share surpassing expectations and its revenue falling short. Shares are down roughly 10% so far in 2026. U.S. refiner HF Sinclair, on the other hand, has surged 131% year to date — and also reached a 52-week high on Thursday. Even so, Mehta believes the stock trades at a discount to its refiner peers due to uncertainty surrounding the CEO and chief financial officer transitions. Both positions are currently interim. “[W]e continue to see value in the company’s non-refining earnings contributions (Lubricants, Renewable Diesel, and Midstream) in addition to the company’s leverage to niche refining markets (West Coast/Rockies and Mid-Continent),” Mehta wrote. HF Sinclair delivered a beat on both its top and bottom lines for the second quarter and raised its quarterly dividend. The stock currently yields about 2%. Mehta’s $114 price target implies 7.5% upside from Wednesday’s close. Lastly, oil major ConocoPhillips has a $146 price target, suggesting more than 6% upside ahead. Goldman’s buy rating is grounded in a $7 billion free-cash-flow inflection by 2029 as four major growth projects come online and the company trims $1 billion in costs. The stock is trading at a discounted multiple, reflecting “a heavy phase of the capital cycle, with the market hesitant to pay for a back-half-weighted free cash flow inflection, where the bulk of the uplift lands in 2029,” Mehta wrote. ConocoPhillips has gained 45% year to date, hitting a 52-week high on Thursday. It currently yields 2.5%.