Connect with us

Technologies

What LastPass Subscribers Need to Do After the Latest Breach

Following the latest breach, you might want to find a new password manager.

LastPass, one of the world’s most popular password managers, is yet again under the microscope after its latest security breach.

In late December, LastPass CEO Karim Toubba acknowledged that a security incident the company first disclosed in August had ultimately paved the way for an unauthorized party to steal customer account information and vault data. This is the latest in a lengthy string of security incidents involving LastPass that date back to 2011.

It’s also the most alarming.

An unauthorized party now has access to unencrypted subscriber account information like LastPass usernames, company names, billing addresses, email addresses, phone numbers and IP addresses, according to Toubba. That same unauthorized party also has a copy of customer vault data, which includes unencrypted data like website URLs and encrypted data like the usernames and passwords for all the sites customers have saved in their vaults. If you’re a LastPass subscriber, the severity of this breach should have you looking for a different password manager because your passwords and personal data are at risk of being exposed.

What should LastPass subscribers do?

The company didn’t specify how many users were affected by the breach, and LastPass didn’t respond to CNET’s request for additional comment on the breach. But if you’re a LastPass subscriber, you need to operate under the assumption that your user and vault data are in the hands of an unauthorized party with ill intentions. Though the most sensitive data is encrypted, the problem is that the threat actor can run «brute force» attacks on those stolen local files. LastPass estimates it would take «millions of years» to guess your master password — if you’ve followed its best practices.

If you haven’t — or if you just want total peace of mind — you’ll need to spend some serious time and effort changing your individual passwords. And while you’re doing that, you’ll probably want to transition away from LastPass, too.

With that in mind, here’s what you need to do right now if you’re a LastPass subscriber:

1. Find a new password manager. Given LastPass’ history with security incidents and considering the severity of this latest breach, now’s a better time than ever to seek an alternative.

2. Change your most important site-level passwords immediately. This includes passwords for anything like online banking, financial records, internal company logins and medical information. Make sure these new passwords are strong and unique.

3. Change every single one of your other online passwords. It’s a good idea to change your passwords in order of importance here too. Start with changing the passwords to accounts like email and social media profiles, then you can start moving backward to other accounts that may not be as critical.

4. Enable two-factor authentication wherever possible. Once you’ve changed your passwords, make sure to enable 2FA on any online account that offers it. This will give you an added layer of protection by alerting you and requiring you to authorize each login attempt. That means even if someone ends up obtaining your new password, they shouldn’t be able to gain access to a given site without your secondary authenticating device (typically your phone).

5. Change your master password. Though this doesn’t change the threat level to the stolen vaults, it’s still prudent to help mitigate the threats of any potential future attack — that is, if you decide you want to stay with LastPass.

LastPass alternatives to consider

  • Bitwarden: CNET’s top password manager is a highly secure and open-source LastPass alternative. Bitwarden’s free tier allows you to use the password manager across an unlimited number of devices across device types. Read our Bitwarden review.
  • 1Password: Another excellent password manager that works seamlessly across platforms. 1Password doesn’t offer a free tier, but you can try it for free for 14 days.
  • iCloud Keychain: Apple’s built-in password manager for iOS, iPadOS and MacOS devices is an excellent LastPass alternative available to Apple users at no additional cost. iCloud Keychain is secure and easy to set up and use across all of your Apple devices. It even offers a Windows client, too, with support for Chrome and Edge browsers.

How did it come to this?

In August 2022, LastPass published a blog post written by Toubba saying that the company «determined that an unauthorized party gained access to portions of the LastPass development environment through a single compromised developer account and took portions of source code and some proprietary LastPass technical information.»

At the time, Toubba said that the threat was contained after LastPass «engaged a leading cybersecurity and forensics firm» and implemented «enhanced security measures.» But that blog post would be updated several times over the following months as the scope of the breach gradually widened.

On Sept. 15, Toubba updated the blog post to notify customers that the company’s investigation into the incident had concluded.

«Our investigation revealed that the threat actor’s activity was limited to a four-day period in August 2022. During this timeframe, the LastPass security team detected the threat actor’s activity and then contained the incident,» Toubba said. «There is no evidence of any threat actor activity beyond the established timeline. We can also confirm that there is no evidence that this incident involved any access to customer data or encrypted password vaults.»

Toubba assured customers at the time that their passwords and personal data were safe in LastPass’s care.

However, it turned out that the unauthorized party was indeed ultimately able to access customer data. On Nov. 30, Toubba updated the blog post once again to alert customers that the company «determined that an unauthorized party, using information obtained in the August 2022 incident, was able to gain access to certain elements of our customers’ information.»

Then, on Dec. 22, Toubba issued a lengthy update to the blog post outlining the unnerving details regarding precisely what customer data the hackers were able to access in the breach. It was then that the full severity of the situation finally came to light and the public found out that LastPass customers’ personal data was in the hands of a threat actor and all of their passwords were at serious risk of being exposed.

Still, Toubba assured customers who follow LastPass’s best practices for passwords and have the latest default settings enabled that no further action on their part is recommended at this time since their «sensitive vault data, such as usernames and passwords, secure notes, attachments, and form-fill fields, remain safely encrypted based on LastPass’ Zero Knowledge architecture.»

However, Toubba warned that those who don’t have LastPass’s default settings enabled and don’t follow the password manager’s best practices are at greater risk of having their master passwords cracked. Toubba suggested that those users should consider changing the passwords of the websites they have stored.

What does all of this mean for LastPass subscribers?

The initial breach ended up allowing the unauthorized party to access sensitive user account data as well as vault data, which means that LastPass subscribers should be extremely concerned for the integrity of the data they have stored in their vaults and should be questioning LastPass’s capacity to keep their data safe.

If you’re a LastPass subscriber, an unauthorized party may have access to personal information like your LastPass username, email address, phone number, name and billing address. IP addresses used when accessing LastPass were also exposed in the breach, which means that the unauthorized party could also see the locations from which you used your account. And because LastPass doesn’t encrypt users’ stored website URLs, the unauthorized party can see all of the websites for which you have login information saved with the password manager (even if the passwords themselves are encrypted).

Information like this gives a potential attacker plenty of ammunition for launching a phishing attack and socially engineering their way to your account passwords. And if you have any password reset links stored that may still be active, an attacker can easily go ahead and create a new password for themselves.

LastPass says that encrypted vault data like usernames and passwords, secure notes and form-filled data that was stolen remains secured. However, if an attacker were to crack your master password at the time of the breach, they would be able to access all of that information, including all the usernames and passwords to your online accounts. If your master password wasn’t strong enough at the time of the breach, your passwords are especially at risk of being exposed.

Changing your master password now will, unfortunately, not help solve the issue because the attackers already have a copy of your vault that was encrypted using the master password you had in place at the time of the breach. This means the attackers essentially have an unlimited amount of time to crack that master password. That’s why the safest course of action is a site-by-site password reset for all of your LastPass-stored accounts. Once changed at the site level, that would mean the attackers would be getting your old, outdated passwords if they managed to crack the stolen encrypted vaults.

For more on staying secure online, here are data privacy tips digital security experts wish you knew and browser settings to change to better guard your information.

Technologies

Today’s NYT Connections Hints, Answers and Help for June 8, #728

Here are some hints and the answers for Connections for June 8, #728.

Looking for the most recent Connections answers? Click here for today’s Connections hints, as well as our daily answers and hints for The New York Times Mini Crossword, Wordle, Connections: Sports Edition and Strands puzzles.


Today’s NYT Connections puzzle could be tricky. The purple category is one of those «sounds like» groups, that can be really tough to figure out. Read on for clues and today’s Connections answers.

The Times now has a Connections Bot, like the one for Wordle. Go there after you play to receive a numeric score and to have the program analyze your answers. Players who are registered with the Times Games section can now nerd out by following their progress, including number of puzzles completed, win rate, number of times they nabbed a perfect score and their win streak.

Read more: Hints, Tips and Strategies to Help You Win at NYT Connections Every Time

Hints for today’s Connections groups

Here are four hints for the groupings in today’s Connections puzzle, ranked from the easiest yellow group, to the tough (and sometimes bizarre) purple group.

Yellow group hint: Keep at it.

Green group hint: Think Wall Street animals.

Blue group hint: Online encyclopedia subheads.

Purple group hint: $$$.

Answers for today’s Connections groups

Yellow group: Persist.

Green group: Animal metaphors in economics.

Blue group: Sidebar info on a person’s Wikipedia page.

Purple group: Homophones of slang for money.

Read more: Wordle Cheat Sheet: Here Are the Most Popular Letters Used in English Words

What are today’s Connections answers?

The yellow words in today’s Connections

The theme is persist. The four answers are hold, last, stand and stay.

The green words in today’s Connections

The theme is animal metaphors in economics. The four answers are bear, bull, dove and hawk.

The blue words in today’s Connections

The theme is sidebar info on a person’s Wikipedia page. The four answers are born, education, occupation and spouse.

The purple words in today’s Connections

The theme is homophones of slang for money. The four answers are bred, cache, doe and lute.

Continue Reading

Technologies

Today’s Wordle Hints, Answer and Help for June 8, #1450

Here are hints and the answer for today’s Wordle No. 1,450 for June 8.

Looking for the most recent Wordle answer? Click here for today’s Wordle hints, as well as our daily answers and hints for The New York Times Mini Crossword, Connections, Connections: Sports Edition and Strands puzzles.


Today’s Wordle puzzle isn’t too tough, especially if your first guesses are heavy on vowels. If you need a new starter word, check out our list of which letters show up the most in English words. If you need hints and the answer, read on.

Today’s Wordle hints

Before we show you today’s Wordle answer, we’ll give you some hints. If you don’t want a spoiler, look away now.

Wordle hint No. 1: Repeats

Today’s Wordle answer has one repeated letter.

Wordle hint No. 2: Vowels

There are two vowels in today’s Wordle answer, but one is the repeated letter, so you’ll see it twice.

Wordle hint No. 3: First letter

Today’s Wordle answer begins with L.

Wordle hint No. 4: Ending

Today’s Wordle answer ends with a vowel.

Wordle hint No. 5: Meaning

Today’s Wordle answer refers to a contract where someone is given the right to use something for a specific time and payment.

TODAY’S WORDLE ANSWER

Today’s Wordle answer is LEASE.

Yesterday’s Wordle answer

Yesterday’s Wordle answer, June 7, No. 1449 was REUSE.

Recent Wordle answers

June 3, No. 1445: ADMIN

June 4, No. 1446: CEASE

June 5, No. 1447: DATUM

June 6, No. 1448: EDIFY

Continue Reading

Technologies

Resident Evil Requiem Revealed, but Where’s Leon Kennedy?

The Resident Evil 9 trailer showed off a new character, but not the much-rumored return of Leon.

After a fake-out earlier in Summer Game Fest on Friday, Resident Evil Requiem, or Resident Evil 9, was shown for the first time. 

The new title is the first mainline entry since Capcom released Resident Evil Village in 2021, and is rumored to feature series stalwart Leon Kennedy. In the trailer, the only person we saw was a character named Grace Ashcroft, who works for the FBI and appears to have ties to Raccoon City.

For the most hardcore Resident Evil fans, the name Ashcroft will ring a bell. Alyssa Ashcroft was one of the survivors of the online-only title, Resident Evil Outbreak for the PS2. Alyssa was a journalist who was trapped in Raccoon City during the events of Resident Evil 2, and she, along with other survivors, had to escape the city before it was destroyed.

Grace is Alyssa’s daughter, and in the trailer, she is going to visit the Remwood Hotel, where Alyssa was murdered. Later in the trailer, images from what appears to be the remnants of a destroyed Raccoon City are shown — including the police department from RE2 — so it appears Resident Evil 9 will return to where the series started. 

Leon’s (rumored) return is a big deal for the series, which has made some of its best games with him in the starring role. He first showed up as a rookie cop in Resident Evil 2, which built on the original game’s success with more story and improved monsters and level design.

He showed up again in Resident Evil 4, which took the series in a new direction by introducing an over-the-shoulder perspective, instead of the usual static camera angles and tank controls. Leon was also one of several playable protagonists in Resident Evil 6, a game that seemed to forget about its survival horror roots. We mostly don’t talk about that one.

But the 2019 remake of Resident Evil 2 was an excellent return to form, bringing RE4’s gameplay and much better graphics to a fan-favorite entry. The RE4 remake was a similar success.

Resident Evil Requiem is set to drop Feb. 27, 2026, for PC, PS5 and Xbox Series consoles, but we’re hoping to get our hands on it this weekend. If you want to catch up on older Resident Evil games, Capcom is having a sale that includes basically all the games, including Village and the three remakes.

Continue Reading

Trending

Copyright © Verum World Media