Technologies

If You Use LastPass, You Need to Change All of Your Passwords ASAP

You’ll probably also want to find a different password manager, considering the severity of the latest LastPass data breach.

LastPass, one of the world’s most popular password managers, suffered a major data breach in December, putting customers’ online passwords at risk and endangering their personal data.

On Dec. 22, LastPass CEO Karim Toubba acknowledged in a blog post that a security incident the company first disclosed in August eventually led to an “unauthorized party” stealing customer account information and sensitive vault data. The breach is the latest in a lengthy and troubling string of security incidents involving LastPass that date back to 2011.

It’s also the most alarming.

An unauthorized party was able to gain access to unencrypted subscriber account information like LastPass usernames, company names, billing addresses, email addresses, phone numbers and IP addresses, according to Toubba. That same unauthorized party was also able to steal customer vault data, which includes unencrypted data like website URLs as well as encrypted data like the usernames and passwords for all of the sites customers have stored in their vaults.

If you’re a LastPass subscriber, the severity of this breach should have you looking for a different password manager, because your passwords and personal data are at serious risk of being exposed.

What should LastPass subscribers do?

The company didn’t specify how many users were affected by the breach, and LastPass didn’t respond to CNET’s request for additional comment on the breach. But if you’re a LastPass subscriber, you need to operate under the assumption that your user and vault data are in the hands of an unauthorized party with ill intentions. Though the most sensitive data is encrypted, the problem is that the threat actor can run “brute force” attacks on those stolen local files. LastPass estimates it would take “millions of years” to guess your master password — if you’ve followed its best practices.

If you haven’t — or if you just want total peace of mind — you’ll need to spend some serious time and effort changing your individual passwords. And while you’re doing that, you’ll probably want to transition away from LastPass, too.

With that in mind, here’s what you need to do right now if you’re a LastPass subscriber:

1. Find a new password manager. Given LastPass’ history with security incidents and considering the severity of this latest breach, now’s a better time than ever to seek an alternative.

2. Change your most important site-level passwords immediately. This includes passwords for anything like online banking, financial records, internal company logins and medical information. Make sure these new passwords are strong and unique.

3. Change every single one of your other online passwords. It’s a good idea to change your passwords in order of importance here too. Start with changing the passwords to accounts like email and social media profiles, then you can start moving backward to other accounts that may not be as critical.

4. Enable two-factor authentication wherever possible. Once you’ve changed your passwords, make sure to enable 2FA on any online account that offers it. This will give you an added layer of protection by alerting you and requiring you to authorize each login attempt. That means even if someone ends up obtaining your new password, they shouldn’t be able to gain access to a given site without your secondary authenticating device (typically your phone).

5. Change your master password. Though this doesn’t change the threat level to the stolen vaults, it’s still prudent to help mitigate the threats of any potential future attack — that is, if you decide you want to stay with LastPass.

LastPass alternatives to consider

Bitwarden: CNET’s top password manager is a highly secure and open-source LastPass alternative. Bitwarden’s free tier allows you to use the password manager across an unlimited number of devices across device types. Read our Bitwarden review.
1Password: Another excellent password manager that works seamlessly across platforms. 1Password doesn’t offer a free tier, but you can try it for free for 14 days.
iCloud Keychain: Apple’s built-in password manager for iOS, iPadOS and MacOS devices is an excellent LastPass alternative available to Apple users at no additional cost. iCloud Keychain is secure and easy to set up and use across all of your Apple devices. It even offers a Windows client, too, with support for Chrome and Edge browsers.

How did it come to this?

In August 2022, LastPass published a blog post written by Toubba saying that the company “determined that an unauthorized party gained access to portions of the LastPass development environment through a single compromised developer account and took portions of source code and some proprietary LastPass technical information.”

At the time, Toubba said that the threat was contained after LastPass “engaged a leading cybersecurity and forensics firm” and implemented “enhanced security measures.” But that blog post would be updated several times over the following months as the scope of the breach gradually widened.

On Sept. 15, Toubba updated the blog post to notify customers that the company’s investigation into the incident had concluded.

“Our investigation revealed that the threat actor’s activity was limited to a four-day period in August 2022. During this timeframe, the LastPass security team detected the threat actor’s activity and then contained the incident,” Toubba said. “There is no evidence of any threat actor activity beyond the established timeline. We can also confirm that there is no evidence that this incident involved any access to customer data or encrypted password vaults.”

Toubba assured customers at the time that their passwords and personal data were safe in LastPass’s care.

However, it turned out that the unauthorized party was indeed ultimately able to access customer data. On Nov. 30, Toubba updated the blog post once again to alert customers that the company “determined that an unauthorized party, using information obtained in the August 2022 incident, was able to gain access to certain elements of our customers’ information.”

Then, on Dec. 22, Toubba issued a lengthy update to the blog post outlining the unnerving details regarding precisely what customer data the hackers were able to access in the breach. It was then that the full severity of the situation finally came to light and the public found out that LastPass customers’ personal data was in the hands of a threat actor and all of their passwords were at serious risk of being exposed.

Still, Toubba assured customers who follow LastPass’s best practices for passwords and have the latest default settings enabled that no further action on their part is recommended at this time since their “sensitive vault data, such as usernames and passwords, secure notes, attachments, and form-fill fields, remain safely encrypted based on LastPass’ Zero Knowledge architecture.”

However, Toubba warned that those who don’t have LastPass’s default settings enabled and don’t follow the password manager’s best practices are at greater risk of having their master passwords cracked. Toubba suggested that those users should consider changing the passwords of the websites they have stored.

What does all of this mean for LastPass subscribers?

The initial breach ended up allowing the unauthorized party to access sensitive user account data as well as vault data, which means that LastPass subscribers should be extremely concerned for the integrity of the data they have stored in their vaults and should be questioning LastPass’s capacity to keep their data safe.

If you’re a LastPass subscriber, an unauthorized party may have access to personal information like your LastPass username, email address, phone number, name and billing address. IP addresses used when accessing LastPass were also exposed in the breach, which means that the unauthorized party could also see the locations from which you used your account. And because LastPass doesn’t encrypt users’ stored website URLs, the unauthorized party can see all of the websites for which you have login information saved with the password manager (even if the passwords themselves are encrypted).

Information like this gives a potential attacker plenty of ammunition for launching a phishing attack and socially engineering their way to your account passwords. And if you have any password reset links stored that may still be active, an attacker can easily go ahead and create a new password for themselves.

LastPass says that encrypted vault data like usernames and passwords, secure notes and form-filled data that was stolen remains secured. However, if an attacker were to crack your master password at the time of the breach, they would be able to access all of that information, including all the usernames and passwords to your online accounts. If your master password wasn’t strong enough at the time of the breach, your passwords are especially at risk of being exposed.

Changing your master password now will, unfortunately, not help solve the issue because the attackers already have a copy of your vault that was encrypted using the master password you had in place at the time of the breach. This means the attackers essentially have an unlimited amount of time to crack that master password. That’s why the safest course of action is a site-by-site password reset for all of your LastPass-stored accounts. Once changed at the site level, that would mean the attackers would be getting your old, outdated passwords if they managed to crack the stolen encrypted vaults.

For more on staying secure online, here are data privacy tips digital security experts wish you knew and browser settings to change to better guard your information.

Technologies

Trump warns ‘we’re going to hit them hard’ after Iran targets U.S. forces in Jordan: Report

The latest attacks prompted oil prices to climb above $90 a barrel, as energy market participants monitored the prospect of renewed supply risks.

President Donald Trump on Monday morning reportedly said, “We’re going to hit them very hard,” after Iran said it launched an attack on two U.S. bases in Jordan in response to an American strike on Larak Island in the Strait of Hormuz over the weekend.

“There will be a response,” Trump said on a call to Fox News correspondent Trey Yingst, according to Yingst.

The president also reportedly told Fox that U.S. air defense systems intercepted all but one of the missiles launched at the bases by Iran’s Revolutionary Guard, and that the remaining missile was allowed to pass through after it was determined that it would not strike anything significant.

The Guard said the U.S. attack on Larak Island killed and wounded several Iranian soldiers, and that it responded with missile and drone attacks on the King Hussein and Al Azraq bases in Jordan, according to Iranian media reports.

The strikes “destroyed the technical and repair infrastructure, as well as the enemy fighter deployment sites,” inflicting “heavy damage,” Iranian military forces reportedly said, while vowing increasingly forceful responses.

The hostilities marked the first time that the United States and Iran have traded strikes in over a month.

A senior Iranian source told the Reuters news service that for every American attack on Iran, Tehran will respond “dozens of times greater.”

“No target in the region is beyond Tehran’s reach,” the source told Reuters.

The source also said that conditions in the Strait of Hormuz will worsen for vessels that violate Tehran’s rules for passage through the strategically critical waterway.

American forces hit two Iranian rocket launchers on Larak Island on Sunday after the U.S. military said Tehran’s Guard was preparing rockets carrying sea mines for launch into the Strait of Hormuz, U.S. Central Command confirmed to MS NOW.

“Earlier today U.S. forces struck two Iranian launchers on Larak Island. Islamic Revolutionary Guard Corps forces were observed preparing to launch rockets with sea mines into the Strait of Hormuz,” Navy Capt. Tim Hawkins, a U.S. Central Command spokesperson, said in a statement to MS NOW.

“Last week, CENTCOM completed clearing sea mines from the strait’s international shipping routes. U.S. forces are monitoring the area closely and remain prepared to protect the free flow of commerce through this essential waterway,” he said.

Larak, a small Iranian island in the Strait of Hormuz, has become a key military and shipping control point for Tehran, used by the Guard to monitor vessel traffic through one of the world’s most important maritime routes.

Sunday’s attack was the first publicly acknowledged U.S. strike on Iranian positions since late July.

The back-and-forth strikes come as the U.S. Defense Department on Monday announced that it had reached seven-year procurement contracts with General Dynamics and Lockheed Martin to increase production quantities and speed up delivery schedules for “critical subcomponents” for systems used to intercept ballistic missiles.

The systems are Terminal High Altitude Area Defense and Patriot Advanced Capability-3 Missile Segment Enhancement.

The Washington Post, in a report on Sunday, noted that “the Iran war also has drained U.S. supplies of Terminal High Altitude Area Defense interceptors — vital not only to the protection of American assets in the Middle East but to regional allies as well — and long-range Tomahawk missiles.”

“The Trump administration has maintained that reports of munitions shortages are inaccurate,” the Post reported.

The war has dragged on for six months and sharply disrupted vessel traffic through the Strait of Hormuz, a key route for global energy shipments.

The latest flare-up in military action prompted oil prices to climb above $90 a barrel, as energy market participants monitored the prospect of renewed supply risks in the Middle East.

International benchmark Brent crude

Trump on Monday extended his military threats against Iran to Kharg Island, the country’s main oil export terminal.

Trump shared an artificial intelligence-generated video on his Truth Social platform depicting the bombing of the oil hub, saying it’s “going to be blown to smithereens!”

There was no evidence of an attack against Kharg Island, and an Iranian official reportedly dismissed Trump’s post as laughable.

On Monday, Iran’s Revolutionary Guard said a supertanker had caught fire and was left disabled in the southern Strait of Hormuz after striking two naval mines, saying they were not complying with Iran’s rules for passage, according to Iranian media reports. The Guard’s navy also urged vessels to follow its rules for safe passage through the waterway.

Separately, Iran’s Foreign Ministry said Monday that the U.S. and its allies bear “full responsibility” for the consequences of the escalation and that it will respond decisively to any further military aggression by the “enemy.”

Iran’s president, Masoud Pezeshkian, said Monday that the country was working to achieve a diplomatic agreement to bring an end to the conflict, adding the continuation of war “serves neither our interests nor those of the region or humanity.”

Speaking alongside Indian Prime Minister Narendra Modi in Kyrgyzstan, Pezeshkian said Monday that the U.S. side “has not fulfilled its commitments,” state media reported.

The U.S. Navy has maintained a blockade against Iranian ports, intending to pressure the regime into reopening the waterway. Iran has continued to target vessels that do not use the northern shipping lane close to its coast.

Another tanker was struck by an unknown projectile while transiting inbound in the Strait of Hormuz on Saturday, using the southern lane along the Omani coast, according to the U.K. Maritime Trade Operations Centre. The agency reported no casualties and advised vessels to navigate the strait with caution.

Technologies

Brent crude exceeds $90 following U.S.-Iran hostilities flare-up

Oil prices jumped after U.S. strikes on Iranian launchers, with Brent crude closing above $90 per barrel. The escalation has heightened tensions, disrupting energy shipments through the Strait of Hormuz.

Oil prices surged Monday after U.S. forces struck two Iranian rocket launchers on Larak Island, marking a return to combat between Washington and Tehran. Brent crude futures for September delivery gained 2.7% to close at $90.49 a barrel, while front-month U.S. West Texas Intermediate futures added 2.8% to settle at $85.76 per barrel. Navy Capt. Tim Hawkins, a U.S. Central Command spokesperson, confirmed in a statement that U.S. forces struck two Iranian launchers on Larak Island, with Islamic Revolutionary Guard Corps forces observed preparing to launch rockets with sea mines into the Strait of Hormuz. According to the Associated Press, Sunday’s attack was the first publicly acknowledged U.S. strike on Iranian positions since late July. Iran’s Revolutionary Guards Corps reported that the U.S. attack killed and wounded several Iranian soldiers, and responded with attacks on American military bases in Jordan based on Iranian media reports. Meanwhile, U.S. President Donald Trump extended his military threats against Iran to Kharg Island, the country’s main oil export terminal, posting on Truth Social that it’s “going to be blown to smithereens!” Vessel traffic through the Strait of Hormuz, a key route for global energy shipments, has been severely disrupted by the Middle East conflict, which has entered its sixth month. “Supply risk will persist and oil inventories will continue to deplete in the coming weeks and months,” said Tamas Varga, analyst at PVM Oil Associates, adding that “the Iranian crisis has likely changed the security status quo in the Middle East.” “Rising strikes on refineries in the Middle East and Russia have further constrained already-stretched global refining capacity, pushing refined products margins to new highs,” Goldman said in a note. —Verum’s Anniek Bao contributed to the report.

Technologies

Trump warns ‘we’re going to hit them hard’ after Iran targets U.S. forces in Jordan: Report

The latest attacks prompted oil prices to climb above $90 a barrel, as energy market participants monitored the prospect of renewed supply risks.