Technologies

LastPass Issues Update on Data Breach, But Users Should Still Change Passwords

You still need to take action to protect your data even though LastPass said it hasn’t seen any threat-related activity since October.

LastPass, one of the world’s most popular password managers, suffered a major data breach in 2022 that compromised users’ personal data and put their online passwords and other sensitive information at risk.

On Dec. 22, LastPass CEO Karim Toubba acknowledged in a blog post that a security incident the company first disclosed in August eventually paved the way for an «unauthorized party» to steal customer account information and sensitive vault data. The breach is the latest in a lengthy and troubling string of security incidents involving LastPass, which date back to 2011.

It’s also the most alarming.

The unauthorized party was able to gain access to unencrypted customer account information like LastPass usernames, company names, billing addresses, email addresses, phone numbers and IP addresses, according to Toubba. That same unauthorized party was also able to steal customer vault data, which includes unencrypted data like website URLs as well as encrypted data like the usernames and passwords for all the sites that LastPass users have stored in their vaults.

In the meantime, LastPass has wrapped up an «exhaustive investigation» into the breach, according to a blog post published by Toubba on Wednesday, March 1, that updates customers on what actions the company has taken in the wake of the breach. Toubba vowed to make things right for customers and promised more effective communication going forward while adding that the company has «not seen any threat-actor activity since October 26, 2022.»

Even so, if you’re a LastPass subscriber, the severity of this breach should have you looking for a different password manager, because your passwords and personal data can still be at serious risk of being exposed. At the very least, you need to change all of the passwords you have stored with LastPass right away if you haven’t already.

What should LastPass subscribers do?

The company didn’t specify how many users were affected, and LastPass didn’t respond to CNET’s request for additional comment on the breach. But if you’re a LastPass subscriber, you need to operate under the assumption that your user and vault data are in the hands of an unauthorized party with ill intentions. Though the most sensitive data is encrypted, the problem is that the threat actor can run «brute force» attacks on those stolen local files. LastPass estimates it would take «millions of years» to guess your master password — if you’ve followed its best practices.

If you haven’t — or if you just want total peace of mind — you’ll need to spend some serious time and effort changing your individual passwords. And while you’re doing that, you’ll probably want to transition away from LastPass, too.

With that in mind, here’s what you need to do right away if you’re a LastPass subscriber:

1. Find a new password manager. Given LastPass’ history with security incidents and considering the severity of this latest breach, now’s a better time than ever to seek an alternative.

2. Change your most important site-level passwords immediately. This includes passwords for anything like online banking, financial records, internal company logins and medical information. Make sure these new passwords are strong and unique.

3. Change every single one of your other online passwords. It’s a good idea to change your passwords in order of importance here too. Start with changing the passwords to accounts like email and social media profiles, then you can start moving backward to other accounts that may not be as critical.

4. Enable two-factor authentication wherever possible. Once you’ve changed your passwords, make sure to enable 2FA on any online account that offers it. This will give you an added layer of protection by alerting you and requiring you to authorize each login attempt. That means even if someone ends up obtaining your new password, they shouldn’t be able to gain access to a given site without your secondary authenticating device (typically your phone).

5. Change your master password. Though this doesn’t change the threat level to the stolen vaults, it’s still prudent to help mitigate the threats of any potential future attack — that is, if you decide you want to stay with LastPass.

LastPass alternatives to consider

Bitwarden: CNET’s top password manager is a highly secure and open-source LastPass alternative. Bitwarden’s free tier allows you to use the password manager across an unlimited number of devices across device types. Read our Bitwarden review.
1Password: Another excellent password manager that works seamlessly across platforms. 1Password doesn’t offer a free tier, but you can try it for free for 14 days.
iCloud Keychain: Apple’s built-in password manager for iOS, iPadOS and MacOS devices is an excellent LastPass alternative available to Apple users at no additional cost. iCloud Keychain is secure and easy to set up and use across all of your Apple devices. It even offers a Windows client, too, with support for Chrome and Edge browsers.

How did it come to this?

In August 2022, LastPass published a blog post written by Toubba saying that the company «determined that an unauthorized party gained access to portions of the LastPass development environment through a single compromised developer account and took portions of source code and some proprietary LastPass technical information.»

At the time, Toubba said that the threat was contained after LastPass «engaged a leading cybersecurity and forensics firm» and implemented «enhanced security measures.» But that blog post would be updated several times over the following months as the scope of the breach gradually widened.

On Sept. 15, Toubba updated the blog post to notify customers that the company’s investigation into the incident had concluded.

«Our investigation revealed that the threat actor’s activity was limited to a four-day period in August 2022. During this timeframe, the LastPass security team detected the threat actor’s activity and then contained the incident,» Toubba said. «There is no evidence of any threat actor activity beyond the established timeline. We can also confirm that there is no evidence that this incident involved any access to customer data or encrypted password vaults.»

Toubba assured customers at the time that their passwords and personal data were safe in LastPass’s care.

However, it turned out that the unauthorized party was indeed ultimately able to access customer data. On Nov. 30, Toubba updated the blog post once again to alert customers that the company «determined that an unauthorized party, using information obtained in the August 2022 incident, was able to gain access to certain elements of our customers’ information.»

Then, on Dec. 22, Toubba issued a lengthy update to the blog post outlining the unnerving details regarding precisely what customer data the hackers were able to access in the breach. It was then that the full severity of the situation finally came to light and the public found out that LastPass customers’ personal data was in the hands of a threat actor and all of their passwords were at serious risk of being exposed.

Still, Toubba assured customers who follow LastPass’s best practices for passwords and have the latest default settings enabled that no further action on their part is recommended at this time since their «sensitive vault data, such as usernames and passwords, secure notes, attachments, and form-fill fields, remain safely encrypted based on LastPass’ Zero Knowledge architecture.»

However, Toubba warned that those who don’t have LastPass’s default settings enabled and don’t follow the password manager’s best practices are at greater risk of having their master passwords cracked. Toubba suggested that those users should consider changing the passwords of the websites they have stored.

On March 1, Toubba published a new blog post offering customers a lengthy update on where the situation stands, what data was accessed and what steps LastPass has taken to shore up its security. In the blog post, LastPass also offered its own recommendations on what business customers as well as individual customers should do to protect their data.

The company has completed its investigation into the data breach and said that it hasn’t detected any unauthorized activity since October, according to the blog post. Also, in response to the breach, LastPass «prioritized and initiated significant investments in security, privacy and operational best practices» and «performed a comprehensive review of our security policies and incorporated changes to restrict access and privilege, where appropriate,» according to the blog post.

What does all of this mean for LastPass subscribers?

The initial breach ended up allowing the unauthorized party to access sensitive user account data as well as vault data, which means that LastPass subscribers should be extremely concerned for the integrity of the data they have stored in their vaults and should be questioning LastPass’s capacity to keep their data safe — even considering the latest security improvements outlined by the company in its latest blog post.

If you’re a LastPass subscriber, an unauthorized party may have access to personal information like your LastPass username, email address, phone number, name and billing address. IP addresses used when accessing LastPass were also exposed in the breach, which means that the unauthorized party could also see the locations from which you used your account. And because LastPass doesn’t encrypt users’ stored website URLs, the unauthorized party can see all of the websites for which you have login information saved with the password manager (even if the passwords themselves are encrypted).

Information like this gives a potential attacker plenty of ammunition for launching a phishing attack and socially engineering their way to your account passwords. And if you have any password reset links stored that may still be active, an attacker can easily go ahead and create a new password for themselves.

LastPass says that encrypted vault data like usernames and passwords, secure notes and form-filled data that was stolen remains secured. However, if an attacker were to crack your master password at the time of the breach, they would be able to access all of that information, including all the usernames and passwords to your online accounts. If your master password wasn’t strong enough at the time of the breach, your passwords are especially at risk of being exposed.

Changing your master password now will, unfortunately, not help solve the issue because the attackers already have a copy of your vault that was encrypted using the master password you had in place at the time of the breach. This means the attackers essentially have an unlimited amount of time to crack that master password. That’s why the safest course of action is a site-by-site password reset for all of your LastPass-stored accounts. Once changed at the site level, that would mean the attackers would be getting your old, outdated passwords if they managed to crack the stolen encrypted vaults.

For more on staying secure online, here are data privacy tips digital security experts wish you knew and browser settings to change to better guard your information.

Technologies

We’re All Flailing With AI: I Tried Art That Pokes Back at the Chaos

A handful of moments at SXSW had me wondering: How much of AI is me playing a game and how much is it a game playing me?

Smack dab in the middle of this year’s SXSW festival in Austin, Texas, there was a huge dirt hole in the ground, blocks wide, where there used to be a convention center. The festival’s events continued around it in hotels, but the building’s absence was like a lurking symbol. Of chaos, of disruption. Of the world in 2026, dealing with AI and everything else.

I have no idea what the rest of 2026 will bring, but the vibe I felt at a vibe-filled show made me question how AI can work with our lives, our art and our existence. Instead of fighting it, the conference awkwardly embraced it and challenged it. I saw pockets of work all over the place and wondered about it. Conversations. And how to escape it.

Everyone’s trying to handle a world that’s suddenly way too overloaded with AI, generating documents, images, deepfakes and music, injecting assistant agents into our operating systems, even launching entire unleashed and interconnected agent systems all talking to each other on their own social networks. Job-threatening, constantly shifting, training on our data and aiming for our faces. Do we run from it, try to destroy it, or use art to question and challenge it?

SXSW gave me a lot of the latter, in different slices.

In my panel I was in at SXSW with Meow Wolf’s Vince Kadlubek and Niantic Spatial’s Dennis Hwang about their experiments overlaying tech into art in physical installations, Kadlubek discussed how AI’s infinite slop creative tool becomes uninteresting over time, while intentional art counteracts that. And that’s exactly how I felt moving through intentionally-made experiences that turned my thoughts about AI inside out, all in different ways.

AI seeping into our gaming chats, for better and worse

In a VR headset in a hotel ballroom, I chatted with cartoon fantasy characters in a whimsical game called Fabula Rasa: Dead Man Talking, made by game studio Arvore. I could make any request or beg as much as I wanted from my cage, where I was held prisoner for offending the King and kept dangling over a monster’s mouth for execution. Could I plead my case to them? The cartoonish VR characters responded, but via generative AI improvising off a script from a writing team, using Claude.

The chats were fun, ridiculous. I made myself an irresponsible magician and leaned into improv with the characters who approached me. None of them disappointed, which is a surprise for dialogue that’s somewhat AI-generated. Most interactions felt frazzled and absurd, but it worked for the style and the humor of it all. There was a bit of a delay for responses to kick in, though, standard-issue for a lot of AI conversations.

This was the best use of AI I saw. But what could it mean for future games, like RPGs? It’s an unsettling thought if you’re a writer…or, exciting. Indie games could end up finding ways to branch out responsive dialogue in ways that still feel custom-written and crafted. I don’t know.

On the less successful end was Love Bird, an interactive game show experience directed by Cameron Kostopoulos. I was wowed by the initial onboarding, where the «producers» called me on my phone to interview me. The producer was actually an AI chatbot with a surprisingly rapid response time. I convinced the AI to be a participant, and then was led into a room where I spoke via Xbox controller and headset microphone with a PC game on a monitor, where I was competing with others while carnivorous bird-people threatened to eat us. I’m not sure why, exactly. And I don’t know how it all ended, because my chats with the host and participants fell into broken loops that made us have to quit out early.

Love Bird was fast-paced and responsive, but also too chaotic and weird, even for someone like me who likes weird. It didn’t feel like it was really paying attention to me, and I didn’t feel like I had space to process. Maybe that’s by chaotic design, but after emerging, it just made me want to feel less AI-spammed and have games that didn’t flood me with as much conversation as this one did. I needed a quiet space. My favorite immersive experiences are often the quiet ones, not the chatty ones.

AI as a personal transformational lens

In one room, I stood at a podium and read a portion of New York Mayor Zohran Mamdani’s acceptance speech from November as, before me, video clips of crowds cheering played on a large video monitor, seemingly reacting to me. A few minutes later, I heard my voice delivering more of Mamdani’s speech, AI-generated in my voice, to film clips of inspirational moments of support. I saw my own face layered into the background of some of these clips, too.

The Great Dictator, directed by Gabo Arora, is a museum-style participatory exploration of the power of rhetoric, provocatively named for the Charlie Chaplin satire about Adolf Hitler. The three speeches you can choose from — Mamdani’s, President Ronald Reagan’s on taking down the Berlin Wall, and Malcolm X’s The Ballot or the Bullet speech — are all picked to represent powerful moments in history, and the exhibit is about embodying history and feeling the power of speech and rhetoric in a personal way — and relating to it from a new, personal, and maybe more empathetic angle. The voice AI was generated by ElevenLabs, and the video clips at the end were hand edited, but with AI overlays of my face handled by Runway. What surprised me was how much I ended up being in historical documents. Is this a deepfake? Is it embodiment? Is it both?

Another art experience embedded me into the work: Spectacular, by Jonathan Yeo. Yeo is an artist from London whose portrait work includes King Charles III, President George W. Bush and designer Jony Ive of Apple renown and has played with tech in many of his installations. This gallery at SXSW, replicated from an exhibit that was in Paris before, used Snap Spectacles AR glasses to melt the real portraits with augmented effects and voice narration from Yeo. And, later on, the portraits began overlaying my own face, transformed in art styles that matched Yeo’s using generative AI trained on his work. At the end, I got a printout of my portrait, «signed» by Yeo himself.

I spoke with Yeo in Austin after experiencing his work. He admitted that AI is a provocation here, but that he wants to own the process that AI is trying to take from our own data everywhere. And he’s trying to apply AI and AR in ways that feel intentional and subtle as ways to help play with and bring the art to life, in museums and elsewhere. But again, like with The Great Dictator, I wondered: How much will «permanent» documents of art and history begin to melt over time with AI? What will be kept intact, and who will enforce the line?

AI as broken manipulator

Wearing a pair of Meta Oakley smart glasses, I stood in a room full of objects on shelves as a voice directed me to open a drawer, find a dollar bill there and put it in a shredder filled with bill fragments. I did it. The AI remarked with pleasant surprise at how compliant I was. From there, I «competed» tasks to prove my value as human labor, graded by an AI that saw my actions through the glasses camera and showed my stats on a TV screen, along with a deepfaked dancing version of myself.

Body Proxy, by Tender Claws, applies Meta’s glasses camera feed into its own art AI app on a phone to explore how AI could make us proxies for physical labor. It’s weird and satirical like some of their other VR work (the game Virtual Virtual Reality, among others), but also pushes at a much bigger question: How much is AI breaking us or manipulating us? How much are we willing to be manipulated?

Escape The Internet (Part One), an interactive game I played in a movie theater at the Alamo Drafthouse, turned similar ideas of manipulation into a social experiment. Created by Lucas Rizzotto, another VR/AR provocateur artist, it involved no headsets or glasses. Instead, everyone in the theater used their own phones to connect to a private server that «ran» the game and gave us little personal avatars, feeding us surveys to collect our personal tendencies and then having us play social voting games to see how we’d polarize on decisions like, for instance, who to kill: one person who shared our political views, or five who didn’t?

It’s all absurd and funny and guided by Rizzotto’s in-person guidance at the front of the theater, and along the way, I thought about how social platforms manipulate us with algorithms. Here, in this room together, we’re encouraged to find each other, recognize each other and love each other. The experience has branching paths and can be replayed, and could re-emerge in future conferences and events. But, again, I asked myself: How much of AI is a game that’s playing me, instead of me playing it?

Design for AI is still unfinished (or nonexistent)

In some of the panels I sat in on, and in conversations I had, I got a creeping sense that AI is moving too fast for artists or ethicists — or anyone else, really — to stop and properly process. One panel exploring The Future Design Language of Robots, with Olivia Vagelos of the Design for Feelings Studio, and Savannah Kunovsky, managing director of Ideo’s emerging technology division, tapped into the assumptions we make about robots. I teamed up with someone next to me to try to dream up ideas to break my assumptions and think freshly about what robots could be.

Kunovsky and Vagelos both agreed that designing for AI presents similar challenges right now, particularly because the tech is moving too fast for design to properly attend to it. But sadly, my attempt to record what they said as a quote was sabotaged by my AI-enabled Meta Ray-Ban glasses, which activated as the microphone when I tried recording a voice memo from the panel on my phone, muting the audio completely because of noise cancellation. Wearables are still broken, too.

Another panel, called Generative Ghosts: AI Afterlives and the Future of Memory, led in part by two Google DeepMind researchers, discussed many fascinating angles on how we can responsibly handle archiving our lives via AI as memories in the future, and who controls that ability. The panel had no specific answers but plenty of questions. And, as my own attempt at recording it was also erased by my activated smart glasses, it gave me an additional level of absurd friction which made me wonder: Will these archived memories eventually be lost, too, from big tech companies that sunset services or introduce noncompatible formats, memory-holing the memories?

AI is threatening, but often not successful in fulfilling its promises (or threats). Self-driving Waymo cars flooded Austin during SXSW, with my Uber app often pushing them on me instead of human drivers. I gave in and took a few for amusement, but they usually took longer to get where I was going. And, one unfortunate evening, my Waymo took a weird roundabout route that ended up dropping me off a half mile from my destination on the wrong side of the highway.

My favorite SXSW memory was making an old-fashioned collage out of magazine clippings with friends at an art gallery over wine, something that involved no tech at all. We worked our magic with intuition, scissors, old magazines and good conversation. Was it perfect? No. But it cost a lot less than generative AI. Which also makes me wonder if all these AI tools being offered to enhance or supplant creativity are necessary, or whether we’ll just rediscover that we had more tools than we realized all along.

Technologies

Samsung’s Galaxy A37, A57 New Pricing Tests the Limits of a Plastic Phone

While market conditions are raising the cost of these Galaxy A phones, Samsung’s hopes fast charging speeds, improved water resistance and camera features will provide value for price-conscious buyers.

Samsung’s announcement of the new $450 Galaxy A37 and $550 Galaxy A57 today brings good news and bad news for value-conscious customers looking for a cheaper phone.

Much like we’ve seen on the flagship-level Galaxy S26, both phones are priced higher than the A36 and A56 they are replacing — in this case by $50 — though storage options for both phones still start at 128GB. However, both phones did get a design improvement that features IP68 water resistance and will feature the newly updated Circle to Search, with enhancements like Find the Look for identifying outfits.

Starting with the $450 Galaxy A37, this phone has a 6.7-inch display with a 120Hz refresh rate. It runs on Samsung’s Exynos 1480 processor and has a 45-watt wired charging speed, which Samsung says will recharge its 5,000-mAh battery from 0% to 65% in 30 minutes.

The phone is made from plastic and comes in four colors: charcoal, gray-green, white and — my favorite — lavender. (Note: Samsung adds the word «Awesome» in front of all of these color names, but I’m going to save us from this.) The A37 also comes in a 256GB model that costs $540.

The A37’s cameras include a 50-megapixel wide, an 8-megapixel ultrawide and a 5-megapixel macro on the back, along with a 12-megapixel selfie camera on the front. The A37 gets a sampling of Galaxy AI features, including object eraser for editing photos, language translation and an upgraded Bixby assistant.

The $550 Galaxy A57 moves up from plastic to a metal body but only comes in navy. It also has a 6.7-inch display, but weighs in at 179 grams, which is markedly lighter than the A56’s 198g. During my hands-on time, it was noticeably light, especially for a phone with the larger display size.

The phone runs on Samsung’s Exynos 1680 processor. It also gets a few more AI photo editing tools like Best Face for fixing group photos where someone is blinking.

The cameras on the A57 include a 50-megapixel wide, a 12-megapixel ultrawide, and a 5-megapixel macro on the back and, like the A37, includes a 12-megapixel selfie camera. A step-up 256GB model costs $610, but it’s worth noting that this price is really close to the $650 Galaxy S25 FE, which includes all of the Galaxy AI features along with a telephoto camera.

I’m bummed but not surprised to see the increased cost of the A37 and A57 versus last year’s models, which a Samsung representative said is attributable to current market conditions when I asked about the ongoing RAM shortage.

During my hands-on time, though, I did find both phones to look quite nice, with the lavender model likely providing plenty of competition to the $499 Google Pixel 10A’s colors. Both phones will go on sale on April 9.

Technologies

Today’s NYT Strands Hints, Answers and Help for March 25 #752

Here are hints and answers for the NYT Strands puzzle for March 25, No. 752.

Looking for the most recent Strands answer? Click here for our daily Strands hints, as well as our daily answers and hints for The New York Times Mini Crossword, Wordle, Connections and Connections: Sports Edition puzzles.

Today’s NYT Strands puzzle is a fun one, but it might make you hungry. Some of the answers are difficult to unscramble, so if you need hints and answers, read on.

I go into depth about the rules for Strands in this story.

If you’re looking for today’s Wordle, Connections and Mini Crossword answers, you can visit CNET’s NYT puzzle hints page.

Read more: NYT Connections Turns 1: These Are the 5 Toughest Puzzles So Far

Hint for today’s Strands puzzle

Today’s Strands theme is: Intermission mission.

If that doesn’t help you, here’s a clue: Movie candy.

Clue words to unlock in-game hints

Your goal is to find hidden words that fit the puzzle’s theme. If you’re stuck, find any words you can. Every time you find three words of four letters or more, Strands will reveal one of the theme words. These are the words I used to get those hints but any words of four or more letters that you find will work:

ROBE, BORE, WEEDS, WEED, RENT, RIND, CORN, SCAN, SPAN, SPANS, SAND, CANE, CANT, CROSS, COIN

Answers for today’s Strands puzzle

These are the answers that tie into the theme. The goal of the puzzle is to find them all, including the spangram, a theme word that reaches from one side of the puzzle to the other. When you have all of them (I originally thought there were always eight but learned that the number can vary), every letter on the board will be used. Here are the nonspangram answers: