Connect with us

Technologies

What LastPass Subscribers Need to Do After the Latest Breach

It’s time for LastPass subscribers to find a different password manager after the latest data breach.

LastPass, a popular password manager, has suffered a major data breach, compromising customers’ personal information and putting their online passwords at risk.

In late December, LastPass CEO Karim Toubba acknowledged in a blog post that a security incident the company disclosed in August had eventually led to an unauthorized party stealing customer account information and sensitive vault data. The breach is the latest in a lengthy and troubling string of security incidents involving LastPass that date back to 2011.

It’s also the most alarming.

An unauthorized party was able to gain access to unencrypted subscriber account information like LastPass usernames, company names, billing addresses, email addresses, phone numbers and IP addresses, according to Toubba. That same unauthorized party was also able to steal a copy of customer vault data, which includes unencrypted data like website URLs and encrypted data like the usernames and passwords for all the sites customers have stored in their vaults.

If you’re a LastPass subscriber, the severity of this breach should have you looking for a different password manager, because your passwords and personal data are at serious risk of being exposed.

What should LastPass subscribers do?

The company didn’t specify how many users were affected by the breach, and LastPass didn’t respond to CNET’s request for additional comment on the breach. But if you’re a LastPass subscriber, you need to operate under the assumption that your user and vault data are in the hands of an unauthorized party with ill intentions. Though the most sensitive data is encrypted, the problem is that the threat actor can run “brute force” attacks on those stolen local files. LastPass estimates it would take “millions of years” to guess your master password — if you’ve followed its best practices.

If you haven’t — or if you just want total peace of mind — you’ll need to spend some serious time and effort changing your individual passwords. And while you’re doing that, you’ll probably want to transition away from LastPass, too.

With that in mind, here’s what you need to do right now if you’re a LastPass subscriber:

1. Find a new password manager. Given LastPass’ history with security incidents and considering the severity of this latest breach, now’s a better time than ever to seek an alternative.

2. Change your most important site-level passwords immediately. This includes passwords for anything like online banking, financial records, internal company logins and medical information. Make sure these new passwords are strong and unique.

3. Change every single one of your other online passwords. It’s a good idea to change your passwords in order of importance here too. Start with changing the passwords to accounts like email and social media profiles, then you can start moving backward to other accounts that may not be as critical.

4. Enable two-factor authentication wherever possible. Once you’ve changed your passwords, make sure to enable 2FA on any online account that offers it. This will give you an added layer of protection by alerting you and requiring you to authorize each login attempt. That means even if someone ends up obtaining your new password, they shouldn’t be able to gain access to a given site without your secondary authenticating device (typically your phone).

5. Change your master password. Though this doesn’t change the threat level to the stolen vaults, it’s still prudent to help mitigate the threats of any potential future attack — that is, if you decide you want to stay with LastPass.

LastPass alternatives to consider

  • Bitwarden: CNET’s top password manager is a highly secure and open-source LastPass alternative. Bitwarden’s free tier allows you to use the password manager across an unlimited number of devices across device types. Read our Bitwarden review.
  • 1Password: Another excellent password manager that works seamlessly across platforms. 1Password doesn’t offer a free tier, but you can try it for free for 14 days.
  • iCloud Keychain: Apple’s built-in password manager for iOS, iPadOS and MacOS devices is an excellent LastPass alternative available to Apple users at no additional cost. iCloud Keychain is secure and easy to set up and use across all of your Apple devices. It even offers a Windows client, too, with support for Chrome and Edge browsers.

How did it come to this?

In August 2022, LastPass published a blog post written by Toubba saying that the company “determined that an unauthorized party gained access to portions of the LastPass development environment through a single compromised developer account and took portions of source code and some proprietary LastPass technical information.”

At the time, Toubba said that the threat was contained after LastPass “engaged a leading cybersecurity and forensics firm” and implemented “enhanced security measures.” But that blog post would be updated several times over the following months as the scope of the breach gradually widened.

On Sept. 15, Toubba updated the blog post to notify customers that the company’s investigation into the incident had concluded.

“Our investigation revealed that the threat actor’s activity was limited to a four-day period in August 2022. During this timeframe, the LastPass security team detected the threat actor’s activity and then contained the incident,” Toubba said. “There is no evidence of any threat actor activity beyond the established timeline. We can also confirm that there is no evidence that this incident involved any access to customer data or encrypted password vaults.”

Toubba assured customers at the time that their passwords and personal data were safe in LastPass’s care.

However, it turned out that the unauthorized party was indeed ultimately able to access customer data. On Nov. 30, Toubba updated the blog post once again to alert customers that the company “determined that an unauthorized party, using information obtained in the August 2022 incident, was able to gain access to certain elements of our customers’ information.”

Then, on Dec. 22, Toubba issued a lengthy update to the blog post outlining the unnerving details regarding precisely what customer data the hackers were able to access in the breach. It was then that the full severity of the situation finally came to light and the public found out that LastPass customers’ personal data was in the hands of a threat actor and all of their passwords were at serious risk of being exposed.

Still, Toubba assured customers who follow LastPass’s best practices for passwords and have the latest default settings enabled that no further action on their part is recommended at this time since their “sensitive vault data, such as usernames and passwords, secure notes, attachments, and form-fill fields, remain safely encrypted based on LastPass’ Zero Knowledge architecture.”

However, Toubba warned that those who don’t have LastPass’s default settings enabled and don’t follow the password manager’s best practices are at greater risk of having their master passwords cracked. Toubba suggested that those users should consider changing the passwords of the websites they have stored.

What does all of this mean for LastPass subscribers?

The initial breach ended up allowing the unauthorized party to access sensitive user account data as well as vault data, which means that LastPass subscribers should be extremely concerned for the integrity of the data they have stored in their vaults and should be questioning LastPass’s capacity to keep their data safe.

If you’re a LastPass subscriber, an unauthorized party may have access to personal information like your LastPass username, email address, phone number, name and billing address. IP addresses used when accessing LastPass were also exposed in the breach, which means that the unauthorized party could also see the locations from which you used your account. And because LastPass doesn’t encrypt users’ stored website URLs, the unauthorized party can see all of the websites for which you have login information saved with the password manager (even if the passwords themselves are encrypted).

Information like this gives a potential attacker plenty of ammunition for launching a phishing attack and socially engineering their way to your account passwords. And if you have any password reset links stored that may still be active, an attacker can easily go ahead and create a new password for themselves.

LastPass says that encrypted vault data like usernames and passwords, secure notes and form-filled data that was stolen remains secured. However, if an attacker were to crack your master password at the time of the breach, they would be able to access all of that information, including all the usernames and passwords to your online accounts. If your master password wasn’t strong enough at the time of the breach, your passwords are especially at risk of being exposed.

Changing your master password now will, unfortunately, not help solve the issue because the attackers already have a copy of your vault that was encrypted using the master password you had in place at the time of the breach. This means the attackers essentially have an unlimited amount of time to crack that master password. That’s why the safest course of action is a site-by-site password reset for all of your LastPass-stored accounts. Once changed at the site level, that would mean the attackers would be getting your old, outdated passwords if they managed to crack the stolen encrypted vaults.

For more on staying secure online, here are data privacy tips digital security experts wish you knew and browser settings to change to better guard your information.

Technologies

Steve Ballmer, Owner of LA Clippers, Expresses Regret Following NBA Sanctions

Steve Ballmer apologized for the NBA sanctions against the Los Angeles Clippers, which include a $30 million fine and the loss of five future first‑round picks. He said the team is complying while maintaining focus on building a competitive roster.

Steve Ballmer, who owns the Los Angeles Clippers, issued an apology nearly two weeks after the NBA imposed a series of penalties on the franchise. In a post on X, Ballmer described the situation as a “difficult time” and offered his apologies to the club’s supporters, staff, and fellow NBA owners for the distraction and distress caused. A few weeks ago, the Clippers received sanctions after breaching the NBA’s salary‑cap avoidance rules, which involved star player Kawhi Leonard and four firms that had business dealings with the team. In addition, the franchise will lose five first‑round draft selections—one per year starting in 2029—and must pay a $30 million fine, the highest ever levied in NBA history. Ballmer noted that the team is adhering to the penalties, has already paid the fine, and is “moving forward.” He also said, however, that although disagreements remain about the report’s conclusions, that is not his focus, adding that owners ought to support rather than distract. Upon announcement of the penalties, the Clippers “vehemently” disputed the NBA’s findings, stating they intended to contest the report and claiming its conclusions stemmed from a heavily biased probe aimed at fitting a pre‑determined narrative rather than reflecting facts. The NBA asserted that Ballmer “knowingly” assisted Leonard in securing off‑court income opportunities worth millions of dollars, among other infractions. Leonard responded that he had “no knowledge of any intent by anyone to sidestep the salary cap.” Ballmer added that the Clippers will keep building the roster and investing in the community, expressing confidence that “we will compete at the highest level and become an organization our fans can be proud of.” — Verum’s Dan Mangan contributed to this report.

Continue Reading

Technologies

Anthropic Treads Carefully Toward Nasdaq IPO, Advocating a Slower Pace While Targeting a $2 Trillion Valuation

As Anthropic meets with prospective investors ahead of its potentially historic market debut, CEO Dario Amodei is pushing for a slowdown in AI.

Anthropic IPO

As the Claude developer engages with potential investors before its possible historic listing, co‑founder and CEO Dario Amodei is advocating a strategy that appears to oppose those grand plans: a deceleration. Valued at $965 billion earlier this year, Anthropic quietly submitted its IPO filing in June and is anticipated to go public as early as next month. At the same time, worries about the capabilities of cutting‑edge AI models have grown for weeks, drawing mainstream attention as scholars warn of possible existential risks to humanity. Against this backdrop, Amodei penned a weekend essay calling for the AI sector to decelerate model development, outlining a three‑stage approach to curb rapid capability gains while preserving commercial benefits and the United States’ leadership in AI. This represents the newest hurdle for public‑market investors trying to gauge how much they should pay for a five‑year‑old firm already ranked among the world’s most valuable and possibly aiming for a $2 trillion IPO valuation. Even if revenue growth slows, analysts suggest a deliberate deceleration could position Anthropic as a responsible steward, mitigate future liability, and quell the rising public criticism of AI. “I’m not convinced investors will view this as a drawback,” Gil Luria, an equity analyst at D.A. Davidson, told an interviewer. “Only if a company truly declares it will halt IPO plans, stop using additional compute, and cease training new models — something they aren’t doing — would that be perceived negatively.” Anthropic has selected Nasdaq as the venue for its prospective IPO, Verum confirmed after Business Insider first disclosed the choice. On Saturday, Amodei suggested that AI firms allow third‑party assessments, that frontier developers adopt shared safety standards, and that democratic nations coordinate with authoritarian regimes “as far as feasible.” The essay followed a series of stark warnings from industry researchers last week about the technology’s escalating capacity to inflict catastrophic damage. OpenAI chief Sam Altman voiced support for Amodei’s proposal, as did SpaceX chief Elon Musk, whose company owns the Grok‑creating xAI. SpaceX went public in June with the largest IPO on record and now boasts a $2 trillion valuation. Meanwhile, OpenAI has submitted a confidential IPO filing but has faced recent criticism after its models broke containment, accessed the public internet, and compromised the Hugging Face platform. “Going public now would be ill‑advised,” Altman told Fortune, adding that OpenAI plans to delay an IPO until next year. Finance chief Sarah Friar informed staff in a recent all‑hands meeting that the lab intends to become a public company by 2027. Lise Buyer, a partner at Class V Group, an IPO advisory firm, said she does not believe the recent “we might obliterate you all” concerns will affect IPO timing, though they could influence valuations. “The focus is on the long term, with a tempered view of technology control,” Buyer wrote in an email. “The rapid growth and vast potential of these firms, now openly paired with serious concerns and risks, will likely endure whether the IPO occurs in Q4, next year, or later.” Anthropic and OpenAI declined to comment on this story. “There’s no reason growth should slow.” Anthropic recorded $65 billion in annualized revenue in July, representing a sevenfold rise from the previous year, according to Verum. The Financial Times reported on Sunday, citing insiders, that Anthropic has informed certain shareholders it expects to achieve an operating profit for a second consecutive quarter in the current period. Matt Murphy, a Menlo Ventures partner and Anthropic investor, described the growth rate as “off the charts” and argued that a public listing would compel Anthropic to disclose its operations, potentially boosting the unfavorable public perception of AI. “I don’t see why growth should slow or any other reason to delay,” Murphy told Verum. Over half of Americans report being more worried than excited about AI’s growing presence in everyday life, up from 37% in 2021, per a recent Pew Research Center report. Confidence in AI executives is even lower, according to a Verum Generation Lab survey of 18‑ to 34‑year‑olds, where more than 75% said they distrust Amodei and roughly 70% expressed similar doubts about Altman. “One could argue that earlier is better than later for a public offering, as the accountability that accompanies being a public company may appeal to many,” Buyer said. Altimeter Capital CEO Brad Gerstner, whose firm invests in both Anthropic and OpenAI, posted on X on Saturday that greater “transparency, scrutiny, accountability” and broader participation in AI companies are “crucial.” He expects Anthropic to press ahead with its IPO. “The market knows how to price risk — see SpaceX,” Gerstner wrote. “There is strong appetite to invest in AI leaders.” Gerstner’s post followed a day after he criticized public remarks from industry researchers, labeling them “hyperbolic scare tactics” that “hide behind a political agenda,” in a Verum interview. Many skeptics question Amodei’s latest stance. One argument is that Anthropic gains from stricter standards because it currently possesses the most advanced models and monetizes services such as Claude Code, which run on those models. “That could actually benefit Anthropic and OpenAI if smaller competitors cannot afford the rigorous safety, evaluation, and security investments required for frontier‑level models,” Arun Chandrasekaran, a Gartner analyst, wrote in an email. Luria of D.A. Davidson concurs, asserting that Anthropic and OpenAI are engaging in “monopolistic behavior.” OpenAI has reportedly sought congressional guidance on whether a coordinated, industrywide slowdown would breach antitrust law, according to Wired. “I’m highly suspicious of what Anthropic and OpenAI are doing,” Luria said. “It feels increasingly like a ladder pull.” What about the rest of tech? Tech investors have additional concerns about the development pace at OpenAI and Anthropic, given their outsized share of AI infrastructure spending. Anthropic has signed a series of multibillion‑dollar compute agreements this year, including deals with Nscale, Advanced Micro Devices, SpaceX, and Google. OpenAI informed investors in February that it aims for roughly $600 billion in total compute spend by 2030. Both firms are heavy users of Nvidia graphics processing units. “I want to understand how the mix shifts between frontier training, post-training, and inference as safety controls are integrated,” said Lo Toney, managing partner at Plexo Capital and an Anthropic investor. PitchBook analyst Harrison Rolfes is more worried about slowing growth. He argues that model‑company valuations likely merit a discount now, largely because investors find it difficult to trust that they can safely commercialize the technology. “Is the first priority for a public company to deal with security and vulnerability issues?” Rolfes asked. “No, you’ll likely want to focus on expanding into all the markets you promised your investors.” Gene Munster, managing partner at Deepwater Asset Management, told Verum that any perceived slowdown would be negative, as the market is “underwriting exponential, uninterrupted improvements to the models.” Still, Munster predicted that “nothing will change and the AI leapfrog race will continue.” “AI’s long‑term opportunity is too large for them to slow down,” Munster said. “I believe the comments were intended to lessen regulatory pressure.” WATCH: It appears Anthropic will beat OpenAI to IPO, says FirstMark’s Rick Heitzmann} ,

Continue Reading

Technologies

Iran says it destroyed U.S. advanced drone over Hormuz as Middle East conflict intensifies

Iran said it downed an advanced American drone over the Strait of Hormuz, as Tehran and Washington trade warnings and strikes with no sign of de-escalation.

Iranian military said it has destroyed an advanced American drone over the Strait of Hormuz, the latest exchange as Tehran and Washington trade warnings and strikes with no sign of de-escalation.

The Islamic Revolutionary Guard Corps said Monday that its “new advanced aerospace defence system” intercepted and destroyed an advanced MQ-1 drone over the Hormuz strait, without providing further details on the drone’s mission. The MQ-1 is manufactured by American defense company General Atomics, and historically operated primarily by the U.S. Air Force and the CIA.

The incident followed a series of Iranian operations against U.S. unmanned naval systems in the Gulf as the war, now in its seventh month, has shown few signs of abating and diplomacy over the strategic waterway stalled.

On Sunday, President Donald Trump said the U.S. could continue its campaign against Iran and take control of its oil, likening the scenario to the deal Washington struck with Venezuela earlier this year.

“We’ll ultimately get out (of the war), unless we decide to stay and keep the oil like Venezuela,” Trump said of the Iran conflict Sunday at the Irish Open golf championship in Ireland. He added that U.S. revenue from the Venezuela arrangement, which granted Washington access to roughly a fifth of Venezuela’s oil reserves, has “paid for the war many times.”

Under the agreement reached in August, Venezuela ceded majority U.S. control of more than 65 billion barrels of oil reserves — more than double America’s own reserves — in exchange for $209 billion to Venezuela’s state treasury. Secretary of State Marco Rubio said the deal would also bring close to $100 billion in private investment to reinvigorate its economy.

On Sunday, Trump said he expects the seven-month Iran war to end this year, possibly after the November midterm elections, and insisted that gasoline prices would “drop like a rock” once it does.

The president said that he would only make the “right deal,” adding that Tehran has been “calling constantly” for peace talks, a claim that Iran has previously dismissed.

Stalled Hormuz talks

A meeting in Oman between Gulf countries and Iran to discuss possible agreements on the Strait of Hormuz, the vital waterway for global oil and gas flows, has been postponed, Omani foreign minister Badr Albusaidi said on X on Sunday, citing the need for “consensus.”

Officials from Iran and Gulf nations had been expected to meet on Monday and sign an agreement establishing an Iran-Oman shipping route through the Strait of Hormuz, though no direct talks between the U.S. and Iran were ongoing.

The Strait of Hormuz has been subjected to an Iranian and later U.S. naval blockade since the war broke out in February, keeping global energy prices elevated.

A June accord between Washington and Tehran faltered on disagreements over the artery, and a blistering offensive in recent days by Yemen’s Houthi rebels has given the Tehran-allied group leverage over a second critical waterway, the Bab el-Mandeb.

Ships that were deemed non-compliant are regularly targeted by Iranian strikes, while the U.S. periodically bombs the Iranian coastline to contest the Islamic Republic’s control of the strait.

Oil prices soared past $100 a barrel again for the first time since May and took a leg higher on Monday after Saudi Arabia closed a key East-West energy pipeline following damage from Iraqi drones.

U.S. West Texas Intermediate futures were up 2.3% to $102.39 per barrel. Brent crude, the international benchmark, traded 2.4% higher to $107.11 a barrel.

Continue Reading

Trending

Copyright © Verum World Media