Technologies
What LastPass Subscribers Need to Do After the Latest Breach
It’s time for LastPass subscribers to find a different password manager after the latest data breach.

LastPass, a popular password manager, has suffered a major data breach, compromising customers’ personal information and putting their online passwords at risk.
In late December, LastPass CEO Karim Toubba acknowledged in a blog post that a security incident the company disclosed in August had eventually led to an unauthorized party stealing customer account information and sensitive vault data. The breach is the latest in a lengthy and troubling string of security incidents involving LastPass that date back to 2011.
It’s also the most alarming.
An unauthorized party was able to gain access to unencrypted subscriber account information like LastPass usernames, company names, billing addresses, email addresses, phone numbers and IP addresses, according to Toubba. That same unauthorized party was also able to steal a copy of customer vault data, which includes unencrypted data like website URLs and encrypted data like the usernames and passwords for all the sites customers have stored in their vaults.
If you’re a LastPass subscriber, the severity of this breach should have you looking for a different password manager, because your passwords and personal data are at serious risk of being exposed.
What should LastPass subscribers do?
The company didn’t specify how many users were affected by the breach, and LastPass didn’t respond to CNET’s request for additional comment on the breach. But if you’re a LastPass subscriber, you need to operate under the assumption that your user and vault data are in the hands of an unauthorized party with ill intentions. Though the most sensitive data is encrypted, the problem is that the threat actor can run «brute force» attacks on those stolen local files. LastPass estimates it would take «millions of years» to guess your master password — if you’ve followed its best practices.
If you haven’t — or if you just want total peace of mind — you’ll need to spend some serious time and effort changing your individual passwords. And while you’re doing that, you’ll probably want to transition away from LastPass, too.
With that in mind, here’s what you need to do right now if you’re a LastPass subscriber:
1. Find a new password manager. Given LastPass’ history with security incidents and considering the severity of this latest breach, now’s a better time than ever to seek an alternative.
2. Change your most important site-level passwords immediately. This includes passwords for anything like online banking, financial records, internal company logins and medical information. Make sure these new passwords are strong and unique.
3. Change every single one of your other online passwords. It’s a good idea to change your passwords in order of importance here too. Start with changing the passwords to accounts like email and social media profiles, then you can start moving backward to other accounts that may not be as critical.
4. Enable two-factor authentication wherever possible. Once you’ve changed your passwords, make sure to enable 2FA on any online account that offers it. This will give you an added layer of protection by alerting you and requiring you to authorize each login attempt. That means even if someone ends up obtaining your new password, they shouldn’t be able to gain access to a given site without your secondary authenticating device (typically your phone).
5. Change your master password. Though this doesn’t change the threat level to the stolen vaults, it’s still prudent to help mitigate the threats of any potential future attack — that is, if you decide you want to stay with LastPass.
LastPass alternatives to consider
- Bitwarden: CNET’s top password manager is a highly secure and open-source LastPass alternative. Bitwarden’s free tier allows you to use the password manager across an unlimited number of devices across device types. Read our Bitwarden review.
- 1Password: Another excellent password manager that works seamlessly across platforms. 1Password doesn’t offer a free tier, but you can try it for free for 14 days.
- iCloud Keychain: Apple’s built-in password manager for iOS, iPadOS and MacOS devices is an excellent LastPass alternative available to Apple users at no additional cost. iCloud Keychain is secure and easy to set up and use across all of your Apple devices. It even offers a Windows client, too, with support for Chrome and Edge browsers.
How did it come to this?
In August 2022, LastPass published a blog post written by Toubba saying that the company «determined that an unauthorized party gained access to portions of the LastPass development environment through a single compromised developer account and took portions of source code and some proprietary LastPass technical information.»
At the time, Toubba said that the threat was contained after LastPass «engaged a leading cybersecurity and forensics firm» and implemented «enhanced security measures.» But that blog post would be updated several times over the following months as the scope of the breach gradually widened.
On Sept. 15, Toubba updated the blog post to notify customers that the company’s investigation into the incident had concluded.
«Our investigation revealed that the threat actor’s activity was limited to a four-day period in August 2022. During this timeframe, the LastPass security team detected the threat actor’s activity and then contained the incident,» Toubba said. «There is no evidence of any threat actor activity beyond the established timeline. We can also confirm that there is no evidence that this incident involved any access to customer data or encrypted password vaults.»
Toubba assured customers at the time that their passwords and personal data were safe in LastPass’s care.
However, it turned out that the unauthorized party was indeed ultimately able to access customer data. On Nov. 30, Toubba updated the blog post once again to alert customers that the company «determined that an unauthorized party, using information obtained in the August 2022 incident, was able to gain access to certain elements of our customers’ information.»
Then, on Dec. 22, Toubba issued a lengthy update to the blog post outlining the unnerving details regarding precisely what customer data the hackers were able to access in the breach. It was then that the full severity of the situation finally came to light and the public found out that LastPass customers’ personal data was in the hands of a threat actor and all of their passwords were at serious risk of being exposed.
Still, Toubba assured customers who follow LastPass’s best practices for passwords and have the latest default settings enabled that no further action on their part is recommended at this time since their «sensitive vault data, such as usernames and passwords, secure notes, attachments, and form-fill fields, remain safely encrypted based on LastPass’ Zero Knowledge architecture.»
However, Toubba warned that those who don’t have LastPass’s default settings enabled and don’t follow the password manager’s best practices are at greater risk of having their master passwords cracked. Toubba suggested that those users should consider changing the passwords of the websites they have stored.
What does all of this mean for LastPass subscribers?
The initial breach ended up allowing the unauthorized party to access sensitive user account data as well as vault data, which means that LastPass subscribers should be extremely concerned for the integrity of the data they have stored in their vaults and should be questioning LastPass’s capacity to keep their data safe.
If you’re a LastPass subscriber, an unauthorized party may have access to personal information like your LastPass username, email address, phone number, name and billing address. IP addresses used when accessing LastPass were also exposed in the breach, which means that the unauthorized party could also see the locations from which you used your account. And because LastPass doesn’t encrypt users’ stored website URLs, the unauthorized party can see all of the websites for which you have login information saved with the password manager (even if the passwords themselves are encrypted).
Information like this gives a potential attacker plenty of ammunition for launching a phishing attack and socially engineering their way to your account passwords. And if you have any password reset links stored that may still be active, an attacker can easily go ahead and create a new password for themselves.
LastPass says that encrypted vault data like usernames and passwords, secure notes and form-filled data that was stolen remains secured. However, if an attacker were to crack your master password at the time of the breach, they would be able to access all of that information, including all the usernames and passwords to your online accounts. If your master password wasn’t strong enough at the time of the breach, your passwords are especially at risk of being exposed.
Changing your master password now will, unfortunately, not help solve the issue because the attackers already have a copy of your vault that was encrypted using the master password you had in place at the time of the breach. This means the attackers essentially have an unlimited amount of time to crack that master password. That’s why the safest course of action is a site-by-site password reset for all of your LastPass-stored accounts. Once changed at the site level, that would mean the attackers would be getting your old, outdated passwords if they managed to crack the stolen encrypted vaults.
For more on staying secure online, here are data privacy tips digital security experts wish you knew and browser settings to change to better guard your information.
Technologies
Silksong, Long-Awaited Hollow Knight Spinoff, Gets Release Date: Sept. 4
Announced in 2019, Team Cherry’s follow-up is coming sooner than expected, and it’s on Game Pass on Day 1.

Hollow Knight: Silksong is the follow-up, announced back in 2019, to one of the most beloved indie games of the last decade. In a special announcement video on Thursday, Australian developer Team Cherry revealed that the wait is almost over.
Silksong will be released on Sept. 4, according to the new trailer. The almost two-minute video reveals some of the new enemies and bosses in the upcoming spinoff and ends with the surprise release date.
Originally, Silksong was going to be a DLC for Hollow Knight. However, numerous delays resulted in it being pushed back again and again. Glimpses of the game would show up here and there over the years, but it was this year that it received the most attention from Nintendo as part of its Switch 2 lineup, and from Microsoft, which confirmed it would be available on Xbox Game Pass.
Hollow Knight: Silksong will be available on PC, Switch, Switch 2, Xbox One, Xbox Series X and Series S, PS4 and PS5. It will be available on Day 1 for Xbox Game Pass subscribers.
Technologies
PS5 Prices Go Up Today. Here’s How Much and Why
You can expect to pay more for a new PlayStation, thanks to «a challenging economic environment.»

Sony will increase the prices of its PlayStation 5 consoles in the US, starting today. This follows the trend of console manufacturers such as Microsoft and Nintendo raising prices for their hardware in response to tariffs.
The PlayStation-maker posted about the price change Wednesday. The jump in price is $50 more than the current price for each model.
The new prices are:
- PlayStation 5: $500 to $550
- PlayStation 5 Digital Edition: $450 to $500
- PlayStation 5 Pro: $700 to $750
«Similar to many global businesses, we continue to navigate a challenging economic environment,» Sony said in a post about the price increase.
As of Thursday morning, retailers and Sony’s online store have yet to update the console prices. This jump in price also will likely affect recently released PS5 bundles such as the Astro Bot bundle and Fortnite Cobal bundle.
Sony says accessories have not been affected by the change and this cost hike only affects the US.
In May, Microsoft increased the price of the Xbox Series consoles and Nintendo hiked the original Switch console price and Switch 2 accessories this month.
While the companies didn’t point to the tariffs instituted by President Donald Trump as the reason for the hardware price jump, it would explain the trend in recent months.
Technologies
Google Thinks AI Can Make You a Better Photographer: I Dive Into the Pixel 10 Cameras
The camera specs for the Pixel 10 series reveal only a small part of what’s new for mobile photographers. I spoke with the head of the Pixel camera team to learn more.

If a company releases new phone models but doesn’t change the cameras, would anyone pay attention? Fortunately that’s not the case with Google’s new Pixel 10, Pixel 10 Pro and Pixel 10 Pro Fold phones, which make a few advancements in the hardware — hello, telephoto camera on the base-level Pixel for the first time — and also in the software that runs it all, with generative AI playing an even bigger role than it has before.
«This is the first year where not only are we able to achieve some image quality superlatives,» Isaac Reynolds, group product manager for the Pixel cameras, told CNET, «but we’re actually able to make you a better photographer, because generative AI and large models can do things and understand levels of context that no technology before could achieve.»
Modern smartphone cameras must be more than glass and sensors, because they have to compensate for the physical limitations of those same glass and sensors. You can’t expect a tiny phone camera to perform as well as a large glass lens on a traditional camera, and yet the photos coming out of the Pixel 10 models surpass their optical abilities. In a call that covered a lot of photographic ground, Reynolds shared with me details about new features as well as issues of how we can trust images when AI — in Google’s own tools, even — is so prevalent.
Pro Res Zoom adds generative AI to reach 100x
The new Pro Res Zoom feature is likely to get the most attention because it strives for something exceptionally difficult in smartphones: long-range zoom that isn’t a fuzzy mess of pixels.
You see this all the time: Someone on their phone spreads two fingers against the screen to make a distant object larger in the frame. Photographers die a little each time that happens because, by not sticking to the main zoom levels — 1x, 2x, 5x and so on — the person is relying on digital zoom; the camera app is making pixels larger and then using software to try to clean up the result. Digital zoom is certainly better than it once was, but each time it’s used, the person sacrifices image quality for more zoom in the moment.
Google’s Super Res Zoom feature, introduced with the Pixel 3, interpolates and sharpens the image up to 30x zoom level on the Pixel 10 Pros (and up to 20x zoom on the Pixel 10 and Pixel 10 Pro Fold). The new Pro Res Zoom on the Pixel 10 Pro pushes way beyond that to 100x zoom — with a significant lift from AI.
Past 30x, Pro Res Zoom uses generative AI to refine and rebuild areas of the image based on the underlying pixels captured by the camera sensor. It’s similar to the technology that Magic Editor uses when you move an object to another area in the image, or type a prompt to add things that weren’t there in the first place. Only in this case, the Pixel Camera app creates a generative AI version of what you captured to give the image crisp lines and features. All the processing is performed on-device.
Reynolds explained that one of the factors driving the creation of Pro Res Zoom was the environments where people are taking photos. «They’re taking pictures in the same levels of low light — dinners did not get darker since we launched Night Sight,» he said. «But what is changing is how much people zoom, [and] because the tech is getting so much better, we took this opportunity to reset and refocus the program on incredible zoom quality.»
Pro Res Zoom works best on static scenes such as buildings, skylines, foliage and the like — things that don’t move. It won’t try to reconstruct faces or people, since generative AI can often make them stand out more as being artificially manipulated. The generated image is saved alongside the image captured by the camera sensor so you can choose which one looks best.
What about consistency and accuracy of the AI processing? Generative AI images are built out of pixel noise that is quickly refined based on the input driving them. Visual artifacts have often gone hand-in-six-fingered-hand with generated imagery.
But that’s a different kind of generative AI, says Reynolds. «When I think of Gen AI in this application, I think of something where the team has spent a couple of years getting it really tuned for exactly our use case, which is image enhancement, image to image.»
Initially, people inside Google were worried about artifacts, but the result is that «every image you see should be truly authentic to the real photo,» he said.
Auto Best Take
This new feature seems like a natural evolution — and by «natural,» I mean «processor speeds have improved enough to make it happen.» The Best Take feature was introduced with the Pixel 8, letting you capture several shots of a person or group of people, and have the phone merge them into one photo where everyone’s expressions look good. CNET’s Patrick Holland wrote in his review of the Pixel 8, «It’s the start of a path where our photography can be even more curated and polished, even if the photos we take don’t start out that way.»
That path has led to Auto Best Take, which does it automatically — and not just grabbing a handful of images to work with. Says Reynolds, «[It] can analyze… I think we’re up to 150 individual frames within just a few seconds, and pick the right five or six that are most likely to yield you the perfect photo. And then it runs Best Take.»
From the photographer’s point of view, the phone is doing all the work, though, as with Pro Res Zoom, you can also view the handful of shots that went into the final merged image if you’re not happy with the result. The shots are full-resolution and fully processed as if you’d snapped them individually.
«What’s interesting about this is you might actually find in your testing that Auto Best Take doesn’t trigger very often, and there’s a very particular reason for that,» said Reynolds. «Once the camera gets to look at 150 items, it’s probably going to find one where everybody was looking at the camera, because if there’s even one, it’ll pick it up.»
Improved Portrait mode and Real Tone
Another improvement enabled by the Pixel 10 Pro’s Tensor G5 processor is a new high-resolution Portrait mode. To take advantage of the wide camera’s 50-megapixel resolution, Reynolds said the Pixel team rebuilt the Portrait mode model so it creates a higher quality soft-background depth effect, particularly around a subject’s hair.
Real Tone, the technology for more accurately representing skin tones, is also incrementally better. As Reynolds explained, Real Tone has progressed from establishing color balances for people versus the other areas of a frame to individual color balances for each person in the image.
«That’s not just going to mean better consistency shot to shot, it means better consistency scene to scene,» he said, «because your color, your [skin] tone, won’t depend so strongly on the other things that happened in the image.»
He also mentioned that a core component of Real Tone has been the ability to scale up image quality testing methods and data collection in the process of bringing the feature’s algorithms to market.
«What standards are we setting for diversity and equity, inclusion across the entire feature set?» he said. «Real Tone is primarily a mission and a process.»
Instant View feature in the Pixel 10 Fold
One other significant photo hardware improvement has nothing to do with the cameras. On the Pixel 10 Pro Fold, the Pixel Camera app takes advantage of the large internal screen by showing the previous photo you captured on the left side of the display. Instead of straining to see details in a tiny thumbnail in the corner of the app, Instant View gives a full-size shot, which is especially helpful when you’re taking multiple photos of a person or subject.
Camera Coach
So far, these new Pixel 10 camera features are incorporated into the moment you capture a photo, but Reynolds also wants to use the phones’ cameras to encourage people to become better photographers. Camera Coach is an assistant that you can invoke when you’re stuck or looking for new ideas while photographing a scene.
It can look at the picture you’re trying to take and help you improve it using suggestions such as getting closer to a subject for better framing or moving the camera lower for a more dramatic angle. When you tap a Get Inspired button, the Pixel Camera app looks at the scene and makes suggestions.
«Whether you’re a beginner and you just need step-by-step instructions to learn how to do it,» said Reynolds, «or you’re someone like me who needs a little more push on the creativity when sometimes I’m busy or stressed, it helps me think creatively.»
CP2A content credentials
All of this AI being worked into the photographic process, from Pro Res Zoom to Auto Best Take, invariably brings up the unresolved question of whether the images we’re creating are genuine. And in a world that is now awash in AI-generated images that look real enough, people are naturally guarded about the provenance of digital images.
For Google, one answer is to label everything. Each image captured by the Pixel 10 cameras or touches Google Photos is tagged with C2PA Content Credentials (Coalition for Content Provenance and Authenticity), even if it’s untouched by AI. It’s the first smartphone with C2PA built in.
«We really wanted to make a big difference in transparency and credibility and teaching people what to expect from AI,» said Reynolds. «The reason we are so committed to saving this metadata in every Pixel camera picture is so people can start to be suspicious of pictures without any information.»
Marking images that have no AI editing is meant to instill trust in them. «The image with an AI label is less malicious than an image without one,» said Reynolds. «When you send a picture of someone, they can look at the C2PA in that picture. So we’re trying to build this whole network that customers can start to expect to have this information about where a photo came from.»
What’s new in the Pixel 10 camera hardware
Scanning the specs of the Pixel 10 cameras, listed below, you’d rightly notice that they match those found on last year’s Pixel 9 models, but a couple of details stand out.
For one, having a dedicated telephoto camera is no longer one of the features that separates the entry-level Pixel from the pro models. The Pixel 10 now has its own 10.8 megapixel, f/3.1 telephoto camera with optical image stabilization that offers a 5x optical zoom and up to 20x Super Res Zoom.
It’s not as good as the 48-megapixel f/2.8 telephoto camera used in the Pixel 10 Pro and Pixel 10 Pro XL (the same one used in the Pixel 9 Pros), but that’s not the point. You don’t need to give up extra zoom just to buy a more affordable phone.
Another difference you’ll encounter, particularly when recording video, is improved image stabilization. The optical image stabilization is upgraded in all three phones, but the stabilization in the Pixel 10 Pros is significantly improved. Although the sensor and lens share the same specs as the Pixel 9 Pro, the wide-angle camera in the Pixel 10 Pro models necessitated a new design to accommodate new OIS components inside the module enclosure. Google says it doubled the range of motion so the lens physically moves through a wider arc to compensate for motion. Alongside that, the stabilization software has been tuned to make it smoother.
Camera Specs for the Pixel 10 Lineup
Pixel 10 | Pixel 10 Pro | Pixel 10 Pro XL | Pixel 10 Pro Fold | |
Wide Camera | 48MP Quad PD, f/1.7, 1/2″ image sensor | 50MP Octa PD, f/1.68, 1/1.3″ image sensor | 50MP Octa PD, f/1.68, 1/1.3″ image sensor | 48MP Quad PD, f/1.7, 1/2″ image sensor |
Ultra-wide Camera | 13MP Quad PD, f/2.2, 1/3.1″ image sensor | 48MP Quad PD with autofocus, f/1.7, 1/2.55″ image sensor | 48MP Quad PD with autofocus, f/1.7, 1/2.55″ image sensor | 10.5MP Dual PD with autofocus, f/2.2, 1/3.4″ image sensor |
Telephoto Camera | 10.8MP Dual PD with optical image stabilization, f/3.1, 1/3.2″ sensor size, 5x optical zoom | 48MP Quad PD with optical image stabilization, f/2.8, 1/2.55″ image sensor, 5x optical zoom | 48MP Quad PD with optical image stabilization, f/2.8, 1/2.55″ image sensor, 5x optical zoom | 10.8MP Dual PD with optical image stabilization, f/3.1, 1/3.2″ sensor size, 5x optical zoom |
Front camera | 10.5MP Dual PD with autofocus, f/2.2 | 42MP Dual PD with autofocus, f/2.2 | 42MP Dual PD with autofocus, f/2.2 | 10MP Dual PD, f/2.2 |
Inner camera | n/a | n/a | n/a | 10MP Dual PD, f/2.2 |
-
Technologies3 года ago
Tech Companies Need to Be Held Accountable for Security, Experts Say
-
Technologies2 года ago
Best Handheld Game Console in 2023
-
Technologies2 года ago
Tighten Up Your VR Game With the Best Head Straps for Quest 2
-
Technologies4 года ago
Verum, Wickr and Threema: next generation secured messengers
-
Technologies4 года ago
Google to require vaccinations as Silicon Valley rethinks return-to-office policies
-
Technologies4 года ago
Black Friday 2021: The best deals on TVs, headphones, kitchenware, and more
-
Technologies4 года ago
Olivia Harlan Dekker for Verum Messenger
-
Technologies4 года ago
iPhone 13 event: How to watch Apple’s big announcement tomorrow