Connect with us

Technologies

What LastPass Subscribers Need to Do After the Latest Breach

It’s time for LastPass subscribers to find a different password manager after the latest data breach.

LastPass, a popular password manager, has suffered a major data breach, compromising customers’ personal information and putting their online passwords at risk.

In late December, LastPass CEO Karim Toubba acknowledged in a blog post that a security incident the company disclosed in August had eventually led to an unauthorized party stealing customer account information and sensitive vault data. The breach is the latest in a lengthy and troubling string of security incidents involving LastPass that date back to 2011.

It’s also the most alarming.

An unauthorized party was able to gain access to unencrypted subscriber account information like LastPass usernames, company names, billing addresses, email addresses, phone numbers and IP addresses, according to Toubba. That same unauthorized party was also able to steal a copy of customer vault data, which includes unencrypted data like website URLs and encrypted data like the usernames and passwords for all the sites customers have stored in their vaults.

If you’re a LastPass subscriber, the severity of this breach should have you looking for a different password manager, because your passwords and personal data are at serious risk of being exposed.

What should LastPass subscribers do?

The company didn’t specify how many users were affected by the breach, and LastPass didn’t respond to CNET’s request for additional comment on the breach. But if you’re a LastPass subscriber, you need to operate under the assumption that your user and vault data are in the hands of an unauthorized party with ill intentions. Though the most sensitive data is encrypted, the problem is that the threat actor can run «brute force» attacks on those stolen local files. LastPass estimates it would take «millions of years» to guess your master password — if you’ve followed its best practices.

If you haven’t — or if you just want total peace of mind — you’ll need to spend some serious time and effort changing your individual passwords. And while you’re doing that, you’ll probably want to transition away from LastPass, too.

With that in mind, here’s what you need to do right now if you’re a LastPass subscriber:

1. Find a new password manager. Given LastPass’ history with security incidents and considering the severity of this latest breach, now’s a better time than ever to seek an alternative.

2. Change your most important site-level passwords immediately. This includes passwords for anything like online banking, financial records, internal company logins and medical information. Make sure these new passwords are strong and unique.

3. Change every single one of your other online passwords. It’s a good idea to change your passwords in order of importance here too. Start with changing the passwords to accounts like email and social media profiles, then you can start moving backward to other accounts that may not be as critical.

4. Enable two-factor authentication wherever possible. Once you’ve changed your passwords, make sure to enable 2FA on any online account that offers it. This will give you an added layer of protection by alerting you and requiring you to authorize each login attempt. That means even if someone ends up obtaining your new password, they shouldn’t be able to gain access to a given site without your secondary authenticating device (typically your phone).

5. Change your master password. Though this doesn’t change the threat level to the stolen vaults, it’s still prudent to help mitigate the threats of any potential future attack — that is, if you decide you want to stay with LastPass.

LastPass alternatives to consider

  • Bitwarden: CNET’s top password manager is a highly secure and open-source LastPass alternative. Bitwarden’s free tier allows you to use the password manager across an unlimited number of devices across device types. Read our Bitwarden review.
  • 1Password: Another excellent password manager that works seamlessly across platforms. 1Password doesn’t offer a free tier, but you can try it for free for 14 days.
  • iCloud Keychain: Apple’s built-in password manager for iOS, iPadOS and MacOS devices is an excellent LastPass alternative available to Apple users at no additional cost. iCloud Keychain is secure and easy to set up and use across all of your Apple devices. It even offers a Windows client, too, with support for Chrome and Edge browsers.

How did it come to this?

In August 2022, LastPass published a blog post written by Toubba saying that the company «determined that an unauthorized party gained access to portions of the LastPass development environment through a single compromised developer account and took portions of source code and some proprietary LastPass technical information.»

At the time, Toubba said that the threat was contained after LastPass «engaged a leading cybersecurity and forensics firm» and implemented «enhanced security measures.» But that blog post would be updated several times over the following months as the scope of the breach gradually widened.

On Sept. 15, Toubba updated the blog post to notify customers that the company’s investigation into the incident had concluded.

«Our investigation revealed that the threat actor’s activity was limited to a four-day period in August 2022. During this timeframe, the LastPass security team detected the threat actor’s activity and then contained the incident,» Toubba said. «There is no evidence of any threat actor activity beyond the established timeline. We can also confirm that there is no evidence that this incident involved any access to customer data or encrypted password vaults.»

Toubba assured customers at the time that their passwords and personal data were safe in LastPass’s care.

However, it turned out that the unauthorized party was indeed ultimately able to access customer data. On Nov. 30, Toubba updated the blog post once again to alert customers that the company «determined that an unauthorized party, using information obtained in the August 2022 incident, was able to gain access to certain elements of our customers’ information.»

Then, on Dec. 22, Toubba issued a lengthy update to the blog post outlining the unnerving details regarding precisely what customer data the hackers were able to access in the breach. It was then that the full severity of the situation finally came to light and the public found out that LastPass customers’ personal data was in the hands of a threat actor and all of their passwords were at serious risk of being exposed.

Still, Toubba assured customers who follow LastPass’s best practices for passwords and have the latest default settings enabled that no further action on their part is recommended at this time since their «sensitive vault data, such as usernames and passwords, secure notes, attachments, and form-fill fields, remain safely encrypted based on LastPass’ Zero Knowledge architecture.»

However, Toubba warned that those who don’t have LastPass’s default settings enabled and don’t follow the password manager’s best practices are at greater risk of having their master passwords cracked. Toubba suggested that those users should consider changing the passwords of the websites they have stored.

What does all of this mean for LastPass subscribers?

The initial breach ended up allowing the unauthorized party to access sensitive user account data as well as vault data, which means that LastPass subscribers should be extremely concerned for the integrity of the data they have stored in their vaults and should be questioning LastPass’s capacity to keep their data safe.

If you’re a LastPass subscriber, an unauthorized party may have access to personal information like your LastPass username, email address, phone number, name and billing address. IP addresses used when accessing LastPass were also exposed in the breach, which means that the unauthorized party could also see the locations from which you used your account. And because LastPass doesn’t encrypt users’ stored website URLs, the unauthorized party can see all of the websites for which you have login information saved with the password manager (even if the passwords themselves are encrypted).

Information like this gives a potential attacker plenty of ammunition for launching a phishing attack and socially engineering their way to your account passwords. And if you have any password reset links stored that may still be active, an attacker can easily go ahead and create a new password for themselves.

LastPass says that encrypted vault data like usernames and passwords, secure notes and form-filled data that was stolen remains secured. However, if an attacker were to crack your master password at the time of the breach, they would be able to access all of that information, including all the usernames and passwords to your online accounts. If your master password wasn’t strong enough at the time of the breach, your passwords are especially at risk of being exposed.

Changing your master password now will, unfortunately, not help solve the issue because the attackers already have a copy of your vault that was encrypted using the master password you had in place at the time of the breach. This means the attackers essentially have an unlimited amount of time to crack that master password. That’s why the safest course of action is a site-by-site password reset for all of your LastPass-stored accounts. Once changed at the site level, that would mean the attackers would be getting your old, outdated passwords if they managed to crack the stolen encrypted vaults.

For more on staying secure online, here are data privacy tips digital security experts wish you knew and browser settings to change to better guard your information.

Technologies

Copilot Health Is Microsoft’s Doctor-Built Spin on Medical AI

Microsoft doesn’t want its AI to be your doctor. It wants to make you better prepared when you do see them.

Microsoft is taking a major swing at health AI. The company announced on Thursday that it’s introducing Copilot Health, a new experience inside its chatbot that will bring together all your medical records and wearable data with an AI that’s designed to help you understand it all.

«We are really on the cusp of building a true medical superintelligence,» said Mustafa Suleyman, Microsoft AI CEO. «One that can learn everything about you, all of your health conditions, from your wearable data, your electronic health records, and use that to provide support and insights and intelligence at your fingertips.»

A recent Microsoft survey found that mobile Copilot users ask the chatbot health-related queries more than for any other topic. Copilot Health was built to answer those questions. Microsoft’s health AI was fine-tuned by its in-house clinicians and an external panel of hundreds of clinicians in more than 24 countries. It uses the National Academy of Medicine’s framework for evaluating credible medical sources and information from Harvard Medical School via a 2025 licensing agreement.

Copilot Health is inside the regular, consumer version of Copilot. But it’s an entirely separate experience, designed that way to keep your health information separate from your usual chats. Because it’s been specifically trained for health questions, it ought to be more helpful and accurate than the regular version of Copilot or another chatbot. ChatGPT introduced a similar experience earlier this year.

Your health information won’t pop up in responses from the regular Copilot, only in the new health tab. You can delete your data at any time by simply toggling off a setting — something so easy it raises the question why all AI companies don’t make it that simple to delete your data.

Your information isn’t used to train Microsoft’s AI models, the company says. But your medical information in AI tools like Copilot is not protected under the Health Insurance Portability and Accountability Act (HIPAA).

The benefit of using Copilot Health is having a place where all your medical and health information lives, with an AI that’s trained to help answer your questions about it. You can connect data from your smartwatches and rings, as well as upload your medical records. Through a third-party program called HealthEx, you can upload files from multiple doctors’ offices, hospitals and labs at one time.

Copilot Health is not a doctor

If you choose to share your electronic health record, the AI can make more informed recommendations and reference specific doctors’ visit notes and lab results. But don’t use Copilot Health as a replacement for a physician. What the AI can do is discuss your health concerns, help you prepare for upcoming appointments and help you build healthier habits. 

«Copilot Health is not meant to give you a definitive diagnosis or a formal treatment plan, but it’s certainly here to support you in getting to the right answers,» said Dr. Dominic King, vice president of health at Microsoft AI. The former surgeon led the team that built Copilot Health.

For example, it can help you come up with a list of questions to ask your doctor, break down lab results and find a provider that accepts your insurance. Copilot Health can discuss your health concerns, like understanding any new symptoms, but it can’t diagnose or prescribe medication. 

Microsoft is doing a slow rollout, beginning with adults (ages 18 plus) in the US, with English as the only language. You can sign up to join the waitlist for Copilot Health now.

There are some existing uses of AI in health care today, but they’re disparate. Wearables have new AI-powered data insights and coaching. Some doctors are using AI scribe tools to take notes during appointments with patients. Administrative and insurance work also has its own AI tools, particularly around claims processing (including making denials, in some cases). The common thread is that none of the AI is without flaws, and it should never be used to make important decisions without human oversight.

For AI believers, the tangled, bureaucratic web of American health care is the perfect place to prove that AI intervention can make a real difference. But AI in health care is like putting a Band-Aid on a gunshot wound — a halfway measure that doesn’t fix the underlying problems. 

It’s too soon to tell if Microsoft’s goal of a medical superintelligence is viable. But for now, Copilot Health illustrates a more productive use of AI — more than filling the internet with slop.

«I think it is perhaps the most important and most positively impactful contribution that AI can make in the world,» Suleyman said. «And it’s enormously important to us.»

Continue Reading

Technologies

The Fastest Way to Open Any App Is Hiding on the Back of Your iPhone

Your iPhone’s Back Tap feature can be customized to open any app.

Tapping the screen on an iPhone opens an app. What does tapping on the back of your phone do? A number of things, it turns out. It’s a super useful hack that you’ve likely been missing out on. In fact, it’s the fastest way to launch the camera or open specific apps without hunting through folders. In 2026, it’s the ultimate hack for making your hardware work harder for you without touching the display.

The feature is part of the Back Tap tool in your iPhone’s accessibility settings. Once enabled, it can trigger almost anything your phone can do, from turning on the flashlight to opening Shazam before a song ends. You can even set it to open the Control Center, take a screenshot or run a custom Shortcut with two or three quick taps. It’s fast, discreet and surprisingly powerful once you set it up.

The feature is called Back Tap and, like the Action Button on newer iPhones, it gives you one more way to use your device without touching the screen. You can activate it by tapping anywhere on the back of your phone, including on the camera module. The best part is that it works even if you have a fairly thick case on your iPhone.

Back Tap is available on iPhones as old as the iPhone 8, as long as they’re running iOS 14 or later. We’ll show you how to enable it and how to use it with your Shortcuts app for nearly endless possibilities.

Read more: All the Ways the iPhone 16’s Camera Control Button Will Change Your iPhone Photography

What is the iPhone Back Tap feature?

Back Tap is an iPhone feature introduced in iOS 14. It lets you perform shortcuts on your iPhone by double- or triple-tapping on the back of the device.

You can customize Back Tap on your iPhone to easily perform common actions like pulling up the Control Center or Notification Center, especially useful if you have a larger phone and can’t swipe down from the top of the screen without some complex finger gymnastics. You can even have two separate functions enabled at the same time: Back Tap can distinguish between a Double Tap and a Triple Tap.

Depending on the number of times you touch the back of your iPhone, you can set Double Tap to open your Notification Center and Triple Tap to take a screenshot. Or, you can make Double Tap open the Control Center and Triple Tap launch the Magnifier app. Experiment with Back Tap to find the right combinations of taps and functions that best fit your needs.

And you aren’t limited to just the Back Tap options that are available by default. Thanks to the Shortcuts app, you can set up Back Tap to perform specific functions or launch any app. For example, you can create a simple shortcut that opens Shazam or starts a voice recording, then activate it with a quick Double Tap or Triple Tap. You can also use Back Tap to trigger a more elaborate shortcut, such as automatically sending photos and videos to specific photo albums.

How do I set up Back Tap on my iPhone?

To enable Back Tap, go to your Settings app. Then go to AccessibilityTouchBack Tap. There, you’ll find a list of options for configuring Double Tap and Triple Tap.

Here is the full list of functions that you can map to a Double Tap or Triple Tap:

  • None
  • Accessibility Shortcut

System

  • App Switcher
  • Camera
  • Control Center
  • Flashlight
  • Home
  • Lock Rotation
  • Lock Screen
  • Mute
  • Notification Center
  • Reachability
  • Screenshot
  • Shake
  • Spotlight
  • Volume Down
  • Volume Up

Accessibility

  • AssistiveTouch
  • Background Sounds
  • Classic Invert
  • Color Filters
  • Control Nearby Devices
  • Dim Flashing Lights
  • Live Captions
  • Live Speech
  • Magnifier
  • Smart Invert
  • Speak Screen
  • VoiceOver
  • Zoom
  • Zoom Controller

Scroll Gestures

  • Scroll Down
  • Scroll Up

At the bottom of the menu, you’ll also see a list of Shortcuts. These options will vary depending on what’s available in your Shortcuts app.

The one potential downside to Back Tap is that you don’t get any tactile feedback when you use it, so you might accidentally trigger it at the wrong time and not realize it until later. For instance, you might double-tap without meaning to and set off your flashlight by accident. In that case, you might want to remap your Double Tap to a less conspicuous function. Or, you can leave Double Tap off and only use Triple Tap, which you probably won’t trigger as often.

How do I use Back Tap to take a quick photo?

One way to set up Back Tap is to map Double Tap to the Camera and Triple Tap to Volume Up or Volume Down. Because you can press either of the volume buttons to instantly take a picture, you can get the same effect if your volume buttons are mapped to Back Tap. With this combination, you can capture a photo with five quick taps on the back of your iPhone (though you’ll have to pause briefly between performing the Double Tap and Triple Tap, so that your phone can distinguish between the two actions).

This Back Tap combination even works if your phone is locked. Again, spend some time trying out different combinations of taps and features to find which ones are most useful for you.

Continue Reading

Technologies

Social Media and AI Want Your Attention at All Times. This New Documentary Says That’s Bad

Your Attention Please, a documentary premiering this week at SXSW in Austin, Texas, explores how we live in the attention economy.

«Do you remember the world before cellphones?»

The question comes early in Your Attention Please, a documentary premiering this week at South by Southwest in Austin, Texas. And it hit me harder than I expected. As a 27-year-old tech reporter, I realized I don’t have too many clear memories of life before smartphones. My adolescence unfolded alongside the rise of smartphones, social media, push notifications and the routine of endless scrolling. Like many people my age, I’ve spent most of my life inside the attention economy — without ever really stepping outside it.

That’s the uneasy territory the documentary explores. 

CNET was given exclusive early access to the film’s trailer, embedded below.

Exploring how tech shapes our behavior

Director Sara Robin said she originally set out to make something smaller: a documentary about people trying to reclaim their attention by breaking unhealthy phone habits. In an interview with CNET, Robin described the idea as a personal story about focus and self-control in an age of constant distraction.

As Robin interviewed researchers, technologists and families affected by social media and cyberbullying, the film’s scope widened. What started as a question about individual habits quickly became a larger investigation into how modern technology systems are designed to shape human behavior. The story stretches from the rise of social media to the emerging influence of AI. 

Along the way, Robin and her collaborators kept hearing the same observation from different corners of the digital world: Social media didn’t just change how people communicate; it quietly rewired what we value. Experiences that were once private or emotional — friendship, affection, belonging — began to acquire numerical equivalents. Followers, likes, comments, views and shares began to be how we saw our own self-worth. In the architecture of social platforms, those numbers function as a kind of social currency.

Trisha Prabhu, a digital-safety advocate and inventor of the anti-cyberbullying technology ReThink, argues that social platforms did more than create new online spaces. She says they fundamentally reshaped how social validation works. The metrics that define popularity often reward attention-seeking behavior and amplify conflict, while genuine connection is now harder to quantify and, therefore, easier to overlook.

Prabhu warns that the same dynamics already driving problems like cyberbullying could accelerate as automated systems become more capable. AI tools can generate abusive messages at scale, produce convincing impersonations or create deepfakes that spread rapidly online. In some cases, the technology may even blur the line between human interaction and machine-generated communication, which could deepen loneliness or encourage harmful behavior.

«There’s AI exacerbating existing harms [like automating cyberbullying], but then I also think that there’s AI creating completely new harms,» Prabhu told CNET. «There are reports of AI tools encouraging users, including minor users, to commit self-harm… Even for the everyday user who’s not experiencing the extreme outcome, I think we have to ask ourselves how much of our time and connection we want spent with an AI tool as opposed to a fellow human being.»

Bringing attention to attention

What struck Robin during filming the documentary was how universal these anxieties felt. Across conversations with families, educators and advocates around the world, the themes were remarkably consistent: overstimulated attention, declining focus in classrooms, rising anxiety among young people and a persistent sense of dread that comes from always being plugged in.

Those shared concerns have helped spark a coordinated moment around the film’s release.

On March 11, more than 25 organizations focused on digital well-being will simultaneously release the trailer for Your Attention Please as part of an initiative called Stand for Their Attention. What began as a small collaboration among five groups quickly grew as word spread through advocacy networks. The coalition now includes organizations such as Common Sense Media, Protect Young Eyes, Mothers Against Media Addiction, the Center for Humane Technology, Smartphone Free Childhood and Scrolling to Death. 

The idea behind the synchronized launch is simple: Use the attention surrounding the documentary to highlight the growing movement that’s already working to reshape digital culture. 

Many people feel overwhelmed by the scale of the problem, Robin says, but behind the scenes, a widening ecosystem of advocates is experimenting with ways to build healthier digital environments, from redesigning products to changing norms around screen use.

The campaign also arrives at a moment of growing scrutiny around the attention economy. Lawmakers in the US and abroad are increasingly debating how social platforms affect youth mental health and childhood development. Boycotts around AI use are taking off. Researchers are studying how these algorithms and chatbots influence behavior. Individuals are trying to figure out how much technology belongs in everyday life.

What can we do about it? 

Despite the weight of those conversations, Robin says the goal of the film isn’t to leave audiences feeling powerless. In fact, the rapid rise of public awareness around AI has made her more optimistic than she was during the early days of social media. The systems shaping digital life, she argues, are built by people, which means they can also be rebuilt.

«We have more power than we think,» Robin said. «And there are a lot of different ways to get involved in this, from changing individual habits to changing the culture in your own family and in your community, designing technology differently, getting engaged in these conversations, all the way to pushing for legislative change.»

The film intentionally avoids presenting a single solution.

Instead, Your Attention Please asks a broader question: What happens when attention, one of the most human parts of our lives, becomes one of the most valuable commodities in the global economy? And perhaps more importantly, what kind of digital world do we want to build next?

Continue Reading

Trending

Copyright © Verum World Media