Technologies

What LastPass Subscribers Need to Do After the Latest Breach

Following the latest breach, you might want to find a new password manager.

LastPass, one of the world’s most popular password managers, is yet again under the microscope after its latest security breach.

In late December, LastPass CEO Karim Toubba acknowledged that a security incident the company first disclosed in August had ultimately paved the way for an unauthorized party to steal customer account information and vault data. This is the latest in a lengthy string of security incidents involving LastPass that date back to 2011.

It’s also the most alarming.

An unauthorized party now has access to unencrypted subscriber account information like LastPass usernames, company names, billing addresses, email addresses, phone numbers and IP addresses, according to Toubba. That same unauthorized party also has a copy of customer vault data, which includes unencrypted data like website URLs and encrypted data like the usernames and passwords for all the sites customers have saved in their vaults. If you’re a LastPass subscriber, the severity of this breach should have you looking for a different password manager because your passwords and personal data are at risk of being exposed.

What should LastPass subscribers do?

The company didn’t specify how many users were affected by the breach, and LastPass didn’t respond to CNET’s request for additional comment on the breach. But if you’re a LastPass subscriber, you need to operate under the assumption that your user and vault data are in the hands of an unauthorized party with ill intentions. Though the most sensitive data is encrypted, the problem is that the threat actor can run «brute force» attacks on those stolen local files. LastPass estimates it would take «millions of years» to guess your master password — if you’ve followed its best practices.

If you haven’t — or if you just want total peace of mind — you’ll need to spend some serious time and effort changing your individual passwords. And while you’re doing that, you’ll probably want to transition away from LastPass, too.

With that in mind, here’s what you need to do right now if you’re a LastPass subscriber:

1. Find a new password manager. Given LastPass’ history with security incidents and considering the severity of this latest breach, now’s a better time than ever to seek an alternative.

2. Change your most important site-level passwords immediately. This includes passwords for anything like online banking, financial records, internal company logins and medical information. Make sure these new passwords are strong and unique.

3. Change every single one of your other online passwords. It’s a good idea to change your passwords in order of importance here too. Start with changing the passwords to accounts like email and social media profiles, then you can start moving backward to other accounts that may not be as critical.

4. Enable two-factor authentication wherever possible. Once you’ve changed your passwords, make sure to enable 2FA on any online account that offers it. This will give you an added layer of protection by alerting you and requiring you to authorize each login attempt. That means even if someone ends up obtaining your new password, they shouldn’t be able to gain access to a given site without your secondary authenticating device (typically your phone).

5. Change your master password. Though this doesn’t change the threat level to the stolen vaults, it’s still prudent to help mitigate the threats of any potential future attack — that is, if you decide you want to stay with LastPass.

LastPass alternatives to consider

Bitwarden: CNET’s top password manager is a highly secure and open-source LastPass alternative. Bitwarden’s free tier allows you to use the password manager across an unlimited number of devices across device types. Read our Bitwarden review.
1Password: Another excellent password manager that works seamlessly across platforms. 1Password doesn’t offer a free tier, but you can try it for free for 14 days.
iCloud Keychain: Apple’s built-in password manager for iOS, iPadOS and MacOS devices is an excellent LastPass alternative available to Apple users at no additional cost. iCloud Keychain is secure and easy to set up and use across all of your Apple devices. It even offers a Windows client, too, with support for Chrome and Edge browsers.

How did it come to this?

In August 2022, LastPass published a blog post written by Toubba saying that the company «determined that an unauthorized party gained access to portions of the LastPass development environment through a single compromised developer account and took portions of source code and some proprietary LastPass technical information.»

At the time, Toubba said that the threat was contained after LastPass «engaged a leading cybersecurity and forensics firm» and implemented «enhanced security measures.» But that blog post would be updated several times over the following months as the scope of the breach gradually widened.

On Sept. 15, Toubba updated the blog post to notify customers that the company’s investigation into the incident had concluded.

«Our investigation revealed that the threat actor’s activity was limited to a four-day period in August 2022. During this timeframe, the LastPass security team detected the threat actor’s activity and then contained the incident,» Toubba said. «There is no evidence of any threat actor activity beyond the established timeline. We can also confirm that there is no evidence that this incident involved any access to customer data or encrypted password vaults.»

Toubba assured customers at the time that their passwords and personal data were safe in LastPass’s care.

However, it turned out that the unauthorized party was indeed ultimately able to access customer data. On Nov. 30, Toubba updated the blog post once again to alert customers that the company «determined that an unauthorized party, using information obtained in the August 2022 incident, was able to gain access to certain elements of our customers’ information.»

Then, on Dec. 22, Toubba issued a lengthy update to the blog post outlining the unnerving details regarding precisely what customer data the hackers were able to access in the breach. It was then that the full severity of the situation finally came to light and the public found out that LastPass customers’ personal data was in the hands of a threat actor and all of their passwords were at serious risk of being exposed.

Still, Toubba assured customers who follow LastPass’s best practices for passwords and have the latest default settings enabled that no further action on their part is recommended at this time since their «sensitive vault data, such as usernames and passwords, secure notes, attachments, and form-fill fields, remain safely encrypted based on LastPass’ Zero Knowledge architecture.»

However, Toubba warned that those who don’t have LastPass’s default settings enabled and don’t follow the password manager’s best practices are at greater risk of having their master passwords cracked. Toubba suggested that those users should consider changing the passwords of the websites they have stored.

What does all of this mean for LastPass subscribers?

The initial breach ended up allowing the unauthorized party to access sensitive user account data as well as vault data, which means that LastPass subscribers should be extremely concerned for the integrity of the data they have stored in their vaults and should be questioning LastPass’s capacity to keep their data safe.

If you’re a LastPass subscriber, an unauthorized party may have access to personal information like your LastPass username, email address, phone number, name and billing address. IP addresses used when accessing LastPass were also exposed in the breach, which means that the unauthorized party could also see the locations from which you used your account. And because LastPass doesn’t encrypt users’ stored website URLs, the unauthorized party can see all of the websites for which you have login information saved with the password manager (even if the passwords themselves are encrypted).

Information like this gives a potential attacker plenty of ammunition for launching a phishing attack and socially engineering their way to your account passwords. And if you have any password reset links stored that may still be active, an attacker can easily go ahead and create a new password for themselves.

LastPass says that encrypted vault data like usernames and passwords, secure notes and form-filled data that was stolen remains secured. However, if an attacker were to crack your master password at the time of the breach, they would be able to access all of that information, including all the usernames and passwords to your online accounts. If your master password wasn’t strong enough at the time of the breach, your passwords are especially at risk of being exposed.

Changing your master password now will, unfortunately, not help solve the issue because the attackers already have a copy of your vault that was encrypted using the master password you had in place at the time of the breach. This means the attackers essentially have an unlimited amount of time to crack that master password. That’s why the safest course of action is a site-by-site password reset for all of your LastPass-stored accounts. Once changed at the site level, that would mean the attackers would be getting your old, outdated passwords if they managed to crack the stolen encrypted vaults.

For more on staying secure online, here are data privacy tips digital security experts wish you knew and browser settings to change to better guard your information.

Technologies

Today’s NYT Connections: Sports Edition Hints and Answers for Feb. 4, #499

Here are hints and the answers for the NYT Connections: Sports Edition puzzle for Feb. 4, No. 499.

Looking for the most recent regular Connections answers? Click here for today’s Connections hints, as well as our daily answers and hints for The New York Times Mini Crossword, Wordle and Strands puzzles.

Today’s Connections: Sports Edition is a tough one. One of the words —«fronton» — might not be known to all the people who attempt the puzzle. There’s also a heavy focus on one specific team, which can be tough if you don’t know that roster well. If today’s puzzle has you stuck but you still want to crack it, keep reading for hints and answers.

Connections: Sports Edition is published by The Athletic, the subscription-based sports journalism site owned by The Times. It doesn’t appear in the NYT Games app, but it does in The Athletic’s own app. Or you can play it for free online.

Read more: NYT Connections: Sports Edition Puzzle Comes Out of Beta

Hints for today’s Connections: Sports Edition groups

Here are four hints for the groupings in today’s Connections: Sports Edition puzzle, ranked from the easiest yellow group to the tough (and sometimes bizarre) purple group.

Yellow group hint: Nice victory!

Green group hint: I’ll give you that guy for this guy.

Blue group hint: Where to play.

Purple group hint: Florida hoops.

Answers for today’s Connections: Sports Edition groups

Yellow group: Win smoothly.

Green group: Fantasy sports trade options.

Blue group: Areas of play, in different sports.

Purple group: Members of the Orlando Magic.

Read more: Wordle Cheat Sheet: Here Are the Most Popular Letters Used in English Words

What are today’s Connections: Sports Edition answers?

The yellow words in today’s Connections

The theme is win smoothly. The four answers are breeze, coast, cruise and waltz.

The green words in today’s Connections

The theme is fantasy sports trade options. The four answers are accept, counter, propose and reject.

The blue words in today’s Connections

The theme is areas of play, in different sports. The four answers are course, court, fronton and rink.

The purple words in today’s Connections

The theme is members of the Orlando Magic. The four answers are Banchero, Bane, Black and Suggs.

Toughest Connections: Sports Edition categories

The Connections: Sports Edition puzzle can be tough, but it really depends on which sports you know the most about. My husband aces anything having to do with Formula 1, my best friend is a hockey buff, and I can answer any question about Minnesota teams.

That said, it’s hard to pick the toughest Connections categories, but here are some I found exceptionally mind-blowing.

#1: Serie A Clubs. Answers: Atalanta, Juventus, Lazio, Roma.

#2: WNBA MVPs. Answers: Catchings, Delle Donne, Fowles and Stewart.

#3: Premier League team nicknames. Answers: Bees, Cherries, Foxes and Hammers.

#4: Homophones of NBA player names. Answers: Barns, Connect, Heart and Hero.

Technologies

Xbox Cloud Gaming Ad-Supported Tier: When Does It Start, How Much Will It Cost and More

Ads could remove the sting of Xbox Game Pass price hikes, but will it be worth it?

Xbox Cloud Gaming is one of the key selling points of Xbox Game Pass, and it generally works well. The service lets gamers stream Xbox titles to a wide range of devices, including phones, tablets, handhelds and select smart TVs from Samsung, LG and Hisense. However, following the Xbox Game Pass price increase from November, streaming alone may not be enough to keep some subscribers on board, which is where an ad-supported tier could come into play.

Microsoft confirmed the existence of an ad-supported tier last year but has not shared details on when it will launch or what it will include. New screenshots shared by players suggest the tier may be arriving soon, though questions remain about how it will work and what limitations it may have.

Don’t miss any of our unbiased tech content and lab-based reviews. Add CNET as a preferred Google source.

When will the Xbox Cloud Gaming ad-supported tier launch?

Microsoft hasn’t made an official announcement yet, but it’s expected to roll out sometime this year, according to Windows Central. Last month, some gamers saw a different loading screen for Xbox Cloud Gaming with a message saying «1 hour of ad-supported play time per session,» which would point to the ads coming soon.

looks like ad-supported Xbox Cloud Gaming is coming soon 👀 pic.twitter.com/c8hAERrVB9

— Tom Warren (@tomwarren) January 17, 2026

How much will the Xbox Cloud Gaming ad-supported tier cost?

In October, Microsoft confirmed it was internally testing the ad-supported tier, and at the time, said it would be free. Going by the load screen message I mentioned earlier, there will likely be a limit on how long people can play on the tier and during internal testing, players would have to watch a 2-minute ad.

What games will be available on the ad-supported tier?

Rumors about the internal testing suggested players would only have access to certain games for free, but the question is, which ones? Microsoft has a significant number of games available to stream, whether it’s purchased digital games or those available with an Xbox Game Pass subscription. Microsoft may allow all the digital games in a player’s library to be streamed and might make a few games available for free on a weekly or monthly basis, similar to the Free Play Days games.

Technologies

My Experience With United’s Starlink Service: How All In-Flight Wi-Fi Should Be

No need to load up devices with movies on long flights. You can stream them — and even live events — on Starlink-equipped United flights.

If I weren’t buckled into a seat, I might not have noticed that I was using in-flight Wi-Fi. When it came to working on my laptop and streaming movies on my phone and tablet, I could have been on my broadband at home.

But instead I was 30,000 feet up connected to Starlink Wi-Fi, on a United Airlines flight between Chicago and Minneapolis and thinking back to all the times I’d fought with expensive, slow, annoying internet access on planes. The ginger ale offered by a friendly attendant was a nice addition, too.

This experience was a demonstration flight on United’s first mainline Boeing 737-800 aircraft to be outfitted with the new satellite hardware. United now offers Starlink Wi-Fi service on 25% of its fleet, which includes 300 regional aircraft and dozens of mainline planes during 2025. It’s aiming to install the low-profile technology on up to 500 aircraft by the end of 2026.

At a time when our phones and smartwatches have satellite connectivity options — helping us reach emergency responders or send text messages when we’re out of range of a cell signal — Starlink and United are providing travelers with an upgraded convenience. What’s more, we’re getting in-flight Wi-Fi with speeds and connectivity that rival what we experience at home or the office.

Air travel presents a conundrum: If you need Wi-Fi in the air and it’s not working, you’re cooked. There’s no stepping out to a coffee shop hotspot or rebooting your home router. In-flight Wi-Fi has improved over the years, but it still feels risky whether it will work well or at all. And you don’t discover that until you’re already in the air.

The plane I traveled on isn’t the first United aircraft carrying Starlink’s satellite Wi-Fi equipment. United began outfitting many of its regional Embraer E175 jets in March after signing a deal with Starlink’s parent company, SpaceX, last year. Although it’s the inaugural United mainline aircraft, Hawaiian Airlines got the jump late last year when it outfitted its Airbus planes with the technology.

The Boeing 737-800 I flew on went into active service the next day, starting with a leg from Houston to Fort Lauderdale. Over the coming months, United expects to outfit approximately 15 mainline Boeing 737-800 planes per month with Starlink antennas.

United is offering Starlink Wi-Fi access free to United MileagePlus members. The Standard Wi-Fi option costs $8 or 1,600 miles for MileagePlus members, or $10 for everybody else. Subscriptions for frequent travelers start at $49 a month (or 7,500 miles).

In-flight Wi-Fi is all about the experience

Believe me, I want to talk about speeds and bandwidth and what a Starlink connection could mean for getting work done or being entertained in the air. But it all starts with getting connected, and too often, that experience sucks.

On my flight from Seattle to Chicago the day before my demo, United’s Standard Wi-Fi took nearly an hour to connect to any of my devices. (United uses different internet providers depending on the aircraft and operating area, and this flight was connected by satellite internet provider ViaSat.) Once the main menu page loaded, selecting most options, including «sign in» and «free messaging,» timed out with an error that there was no network connection.

That cut into my work time, but more importantly, it was incredibly frustrating. Many of us look forward to focused time on a flight to get things done without interruptions, and more frustration is the last thing we want to add to our air travel experience.

Two experiences stood out when I was on the Starlink-equipped plane. First, it operates gate-to-gate, so you can connect on your phone or tablet (laptops still need to be put away during takeoff) as soon as you get settled in your seat. After we’d landed and were taxiing back to the gate, I forgot that I was still connected through Starlink.

For almost as long as I’ve owned a cellphone, wheels-down meant it’s time to switch off Airplane mode and embrace the familiar connection of local cellular.

Second, the few sign-on steps I had to go through weren’t any more onerous than getting on a public cafe or hotel Wi-Fi network. After connecting to the United Wi-FI network, a portal window opened with a trio of screens explaining how great the new service is (you can skip them) and a field to enter my United MileagePlus account and password.

Oh, and then there’s a video ad, which is 15 seconds or less. (If you’ve been reading so far and thinking, «Wait, it can’t really be free, can it?» there’s your answer.) That ad turns out to be important: You aren’t connected until the video completes.

I was impatient and dismissed the ad on my laptop, which led to some trouble getting connected. Another journalist on the flight mentioned that he encountered the same situation, and the friendly United tech staff on the flight were curious whether the ad had played when they helped me diagnose the issue. I also emptied my browser caches and told the computer to forget the Wi-Fi network, essentially starting me from scratch.

As far as I can tell, no one else on the flight experienced this problem, but it’s safe to say there could have been some prelaunch bugs being worked out. United’s tech support won’t be on hand for regular flights, which is why one of them mentioned they were trying to iron out any points where flyers might run into difficulty.

Once connected, I could concentrate on trying to use as much bandwidth as possible and look outside occasionally since United scheduled this flight on a beautiful autumn day (instead of bringing everyone to Chicago in the dead of winter).

How Starlink Wi-Fi performed

The hardware that makes this happen is a pair of low-profile 500Mbps antennas mounted on the top of the fuselage. Unlike current units on planes offering standard Wi-Fi, the antennas are essentially exposed to communicate with the network of nearly 8,000 Starlink satellites operating in low Earth orbit (LEO), or about 350 miles in altitude.

To compare, the antenna module on a non-Starlink-equipped United plane parked at the next gate was much larger to shield its antennas, which need to adjust their angles during flight to talk to high-altitude satellites about 22,000 miles up.

In the time it takes a signal to go from a plane to high-altitude satellites, the signal can round-trip the distance between an aircraft and the Starlink satellites 70 times, according to Mara Palcisco, United Airlines vice president of engineering and reliability.

(This is also different from T-Satellite, the Starlink-powered satellite technology offered by T-Mobile. T-Satellite uses a separate collection of satellites to work with phones using a portion of the cellular spectrum.)

What does that mean in terms of the internet experience? Honestly, I’d think I was at home on my high-speed fiber internet if not for the cabin noise and the occasional tight banking turn. I streamed the (underrated, in my opinion) movie Cowboys & Aliens over Netflix on my iPad, played one of United’s available videos in a window on my MacBook Pro and watched YouTube videos on my iPhone.

Also, because this was a special flight for the press and several United employees, I initiated a video call with two colleagues. Usually, video and voice calls are not allowed — in fact, they’re illegal — and United makes a point of telling customers that they shouldn’t engage in any behavior that disturbs the people around them, including calls, listening to audio without headphones or watching media that would make others uncomfortable. You can watch a live call, but technically not talk on one, and that’s behavior flight attendants will have to enforce.

In this instance, we were encouraged to go ahead, so I had a hard-to-hear video conference with CNET managing editor Patrick Holland and senior reporter David Lumb (maybe it’s time to invest in a pair of AirPods Pro 3). The video quality was stellar — no, I’m not making a Starlink pun, I promise — even better than a few recent calls we’ve had in our respective offices. A FaceTime call with a friend was similar: clear, sharp video with no telltale streaming artifacts.

But let’s get to numbers. It’s always a nerd joy to go to Speedtest.net or run the Speedtest app and be surprised at the numbers it sends back. I consistently got around 250Mbps of download speed and anywhere from 25Mbps to 65Mbps upload speed. I saw that on all of my devices: iPhone 17 Pro, M1 iPad Pro and a 2021 MacBook Pro with an M1 Pro chip.

To put that into perspective, SpaceX says that Starlink residential internet gets up to 350Mbps download speeds, depending on location. According to an Ookla report, Starlink’s median performance is 105Mbps download, 15Mbps upload and 45ms latency. CNET senior writer Joe Supan saw similar performance when recently testing the Starlink Mini in Washington’s North Cascades mountains. (Disclosure: CNET’s parent company, Ziff Davis, also owns Ookla.)

To make what now looks like an unfair comparison, when I did get United’s standard Wi-Fi access the night before (which I paid $8 for), my speeds were 9.65Mbps down and 1.03Mbps up. Yes, those decimal points are in the correct places.

Streaming video, whether watching in-flight movies, catching up on a series on Netflix or Apple TV or watching live sports, will undoubtedly become more prevalent on flights when this level of bandwidth is available. In fact, when I chatted during the flight with Grant Milstead, United vice president of digital technology, I asked whether the in-flight videos available via United’s portal were cached on a server aboard the plane. (On my flight the previous night, I could view those even when an internet connection was elusive.)

He said that for mainline flights, which carry roughly 170 passengers, the company would still maintain those local servers for redundancy. But the regional Embraer E175 jets, the first of United’s fleet to be outfitted with the Starlink technology, rely on streamed content with no local backup. Given that the video and audio quality, from my perspective, was indistinguishable from broadband at home, that doesn’t come as a surprise.

While waiting for my trip back home (on a plane not equipped with Starlink Wi-Fi), I pondered my lasting impression of this assignment, which had me fly to Chicago, circle above Wisconsin for a couple of hours and then fly back to Seattle.

On my flight with Starlink Wi-Fi, I had uncompromised internet access. I wasn’t thinking about latency, artifacts or whether I was getting my $8 worth. I could work, watch videos, play live video games and just be bothered with any of the usual complications. And that was the best experience.