Technologies

If You Use LastPass, You Need to Change All of Your Passwords ASAP

You’ll probably also want to find a different password manager, considering the severity of the latest LastPass data breach.

LastPass, one of the world’s most popular password managers, suffered a major data breach in December, putting customers’ online passwords at risk and endangering their personal data.

On Dec. 22, LastPass CEO Karim Toubba acknowledged in a blog post that a security incident the company first disclosed in August eventually led to an “unauthorized party” stealing customer account information and sensitive vault data. The breach is the latest in a lengthy and troubling string of security incidents involving LastPass that date back to 2011.

It’s also the most alarming.

An unauthorized party was able to gain access to unencrypted subscriber account information like LastPass usernames, company names, billing addresses, email addresses, phone numbers and IP addresses, according to Toubba. That same unauthorized party was also able to steal customer vault data, which includes unencrypted data like website URLs as well as encrypted data like the usernames and passwords for all of the sites customers have stored in their vaults.

If you’re a LastPass subscriber, the severity of this breach should have you looking for a different password manager, because your passwords and personal data are at serious risk of being exposed.

What should LastPass subscribers do?

The company didn’t specify how many users were affected by the breach, and LastPass didn’t respond to CNET’s request for additional comment on the breach. But if you’re a LastPass subscriber, you need to operate under the assumption that your user and vault data are in the hands of an unauthorized party with ill intentions. Though the most sensitive data is encrypted, the problem is that the threat actor can run “brute force” attacks on those stolen local files. LastPass estimates it would take “millions of years” to guess your master password — if you’ve followed its best practices.

If you haven’t — or if you just want total peace of mind — you’ll need to spend some serious time and effort changing your individual passwords. And while you’re doing that, you’ll probably want to transition away from LastPass, too.

With that in mind, here’s what you need to do right now if you’re a LastPass subscriber:

1. Find a new password manager. Given LastPass’ history with security incidents and considering the severity of this latest breach, now’s a better time than ever to seek an alternative.

2. Change your most important site-level passwords immediately. This includes passwords for anything like online banking, financial records, internal company logins and medical information. Make sure these new passwords are strong and unique.

3. Change every single one of your other online passwords. It’s a good idea to change your passwords in order of importance here too. Start with changing the passwords to accounts like email and social media profiles, then you can start moving backward to other accounts that may not be as critical.

4. Enable two-factor authentication wherever possible. Once you’ve changed your passwords, make sure to enable 2FA on any online account that offers it. This will give you an added layer of protection by alerting you and requiring you to authorize each login attempt. That means even if someone ends up obtaining your new password, they shouldn’t be able to gain access to a given site without your secondary authenticating device (typically your phone).

5. Change your master password. Though this doesn’t change the threat level to the stolen vaults, it’s still prudent to help mitigate the threats of any potential future attack — that is, if you decide you want to stay with LastPass.

LastPass alternatives to consider

Bitwarden: CNET’s top password manager is a highly secure and open-source LastPass alternative. Bitwarden’s free tier allows you to use the password manager across an unlimited number of devices across device types. Read our Bitwarden review.
1Password: Another excellent password manager that works seamlessly across platforms. 1Password doesn’t offer a free tier, but you can try it for free for 14 days.
iCloud Keychain: Apple’s built-in password manager for iOS, iPadOS and MacOS devices is an excellent LastPass alternative available to Apple users at no additional cost. iCloud Keychain is secure and easy to set up and use across all of your Apple devices. It even offers a Windows client, too, with support for Chrome and Edge browsers.

How did it come to this?

In August 2022, LastPass published a blog post written by Toubba saying that the company “determined that an unauthorized party gained access to portions of the LastPass development environment through a single compromised developer account and took portions of source code and some proprietary LastPass technical information.”

At the time, Toubba said that the threat was contained after LastPass “engaged a leading cybersecurity and forensics firm” and implemented “enhanced security measures.” But that blog post would be updated several times over the following months as the scope of the breach gradually widened.

On Sept. 15, Toubba updated the blog post to notify customers that the company’s investigation into the incident had concluded.

“Our investigation revealed that the threat actor’s activity was limited to a four-day period in August 2022. During this timeframe, the LastPass security team detected the threat actor’s activity and then contained the incident,” Toubba said. “There is no evidence of any threat actor activity beyond the established timeline. We can also confirm that there is no evidence that this incident involved any access to customer data or encrypted password vaults.”

Toubba assured customers at the time that their passwords and personal data were safe in LastPass’s care.

However, it turned out that the unauthorized party was indeed ultimately able to access customer data. On Nov. 30, Toubba updated the blog post once again to alert customers that the company “determined that an unauthorized party, using information obtained in the August 2022 incident, was able to gain access to certain elements of our customers’ information.”

Then, on Dec. 22, Toubba issued a lengthy update to the blog post outlining the unnerving details regarding precisely what customer data the hackers were able to access in the breach. It was then that the full severity of the situation finally came to light and the public found out that LastPass customers’ personal data was in the hands of a threat actor and all of their passwords were at serious risk of being exposed.

Still, Toubba assured customers who follow LastPass’s best practices for passwords and have the latest default settings enabled that no further action on their part is recommended at this time since their “sensitive vault data, such as usernames and passwords, secure notes, attachments, and form-fill fields, remain safely encrypted based on LastPass’ Zero Knowledge architecture.”

However, Toubba warned that those who don’t have LastPass’s default settings enabled and don’t follow the password manager’s best practices are at greater risk of having their master passwords cracked. Toubba suggested that those users should consider changing the passwords of the websites they have stored.

What does all of this mean for LastPass subscribers?

The initial breach ended up allowing the unauthorized party to access sensitive user account data as well as vault data, which means that LastPass subscribers should be extremely concerned for the integrity of the data they have stored in their vaults and should be questioning LastPass’s capacity to keep their data safe.

If you’re a LastPass subscriber, an unauthorized party may have access to personal information like your LastPass username, email address, phone number, name and billing address. IP addresses used when accessing LastPass were also exposed in the breach, which means that the unauthorized party could also see the locations from which you used your account. And because LastPass doesn’t encrypt users’ stored website URLs, the unauthorized party can see all of the websites for which you have login information saved with the password manager (even if the passwords themselves are encrypted).

Information like this gives a potential attacker plenty of ammunition for launching a phishing attack and socially engineering their way to your account passwords. And if you have any password reset links stored that may still be active, an attacker can easily go ahead and create a new password for themselves.

LastPass says that encrypted vault data like usernames and passwords, secure notes and form-filled data that was stolen remains secured. However, if an attacker were to crack your master password at the time of the breach, they would be able to access all of that information, including all the usernames and passwords to your online accounts. If your master password wasn’t strong enough at the time of the breach, your passwords are especially at risk of being exposed.

Changing your master password now will, unfortunately, not help solve the issue because the attackers already have a copy of your vault that was encrypted using the master password you had in place at the time of the breach. This means the attackers essentially have an unlimited amount of time to crack that master password. That’s why the safest course of action is a site-by-site password reset for all of your LastPass-stored accounts. Once changed at the site level, that would mean the attackers would be getting your old, outdated passwords if they managed to crack the stolen encrypted vaults.

For more on staying secure online, here are data privacy tips digital security experts wish you knew and browser settings to change to better guard your information.

Technologies

Iranian President Pezeshkian to head to New York for UN meeting as Trump warns of no-deal consequences

Trump threatened to destroy Iran’s economy or eliminate its leadership if Tehran doesn’t strike a deal, complicating efforts at diplomacy.

President Masoud Pezeshkian will lead an Iranian delegation at the United Nations General Assembly in New York on Tuesday, amid renewed hopes for a diplomatic solution to the Middle East conflict.

Pezeshkian will address the assembly and present Iran’s positions on “international developments,” according to the country’s semi-official Tasnim news agency, with a particular focus on its war with the U.S. and Israel.

He will also hold talks with the leaders of several countries on the sidelines of the event, which is scheduled to take place Sept. 22 to 26, and 28.

The Iranian delegation’s attendance at the UN has renewed hopes for a diplomatic solution to the war, lifting market sentiment on Monday, with stocks rising, oil prices easing and global bond yields falling sharply.

But U.S. President Donald Trump, who has said he would be open to meeting Pezeshkian during the assembly, has threatened to destroy Iran’s economy or eliminate its leadership if Tehran doesn’t strike a deal.

Trump told Fox News on Sunday that the only options on the table were “wiping Iran out,” or letting its economy “rot,” unless both sides reach a deal.

Separately, Iran’s military said that its intelligence suggested a new, large-scale strike being prepared by the U.S. and its allies, warning of “painful” retaliation across the Middle East. Regional countries backing such a strike would be treated as parties to the conflict, it said.

“If the U.S. makes any mistake against the Islamic Republic of Iran, all its positions and interests in the region will be targeted by sustained, effective and painful attacks,” the Khatam al-Anbia Central Headquarters of Iran said, according to Tasnim.

Houthi-Saudi conflict complicates diplomacy hopes

The U.S. State Department this weekend issued a security alert citing risks of unforeseen escalation in the Middle East, telling Americans to exercise more vigilance and be aware of possible flight cancellations and airspace closures.

The warnings came after Iran-backed Houthi militants claimed missile and drone attacks on Riyadh on Saturday, triggering the first air-raid alert in the Saudi capital since fighting escalated in July.

Saudi authorities said they intercepted and destroyed a ballistic missile and reported no casualties or damage. The Houthis also attempted to target civilians and infrastructure in several parts of the kingdom, Saudi-led coalition forces spokesperson Major-General Turki al-Maliki said on X on Saturday, though those attacks were thwarted by the country’s air defenses.

Oil prices have pulled back in recent days despite widening hostilities, as traders hope for a recovery in energy shipments from oil-rich Saudi Arabia.

Oil prices will remain high despite U.S. progress in moving oil through the Strait of Hormuz, a team of analysts at Eurasia Group said in a Saturday note. Any rebound in oil flows would not be enough to address the overall market deficit, they said, forecasting Brent prices to trade in a higher band of $90-110 per barrel through the rest of this year.

“Iran’s leadership will stick with resistance, even as they quarrel internally,” according to the consultancy firm, as Tehran seeks to use military proxies and tanker attacks to keep a chokehold on shipping flows, to pressure Washington into concessions.

Tehran has insisted that it would not reopen the Strait of Hormuz until Washington fulfills its commitment under the June memorandum, which called for lifting the naval blockade of Iranian ports, easing sanctions, unfreezing Iranian assets and ending U.S. military threats.

Iranian parliament speaker Mohammad Bagher Ghalibaf said Sunday that Iran must keep on fighting and negotiating, to push back its enemies, and only work on diplomacy when it has the upper hand on the battlefield.

Technologies

U.S. crude oil drops below $100 a barrel as Trump signals willingness to negotiate with Iran

U.S. crude oil prices slipped back below $100 a barrel after President Trump signaled openness to talks with Iran and halted plans to bomb Yemen, while Middle East supply flows remained robust despite pipeline disruptions.

Crude oil prices declined for the fourth straight session on Monday after President Donald Trump reportedly decided against bombing Yemen for the time being and indicated he was open to diplomatic engagement with Iran.

U.S. West Texas Intermediate futures fell 2.7% to $97.59 per barrel by 7:48 a.m. ET, while Brent crude, the global benchmark, slipped 2.8% to $101 a barrel. The market has risen more than 11% so far this month.

Trump told Fox News he would likely be receptive to meeting Iranian President Masoud Pezeshkian at the United Nations General Assembly later this week.

According to The New York Times, the president has decided not to target the Iran‑aligned Houthi militants for now, despite requests from Saudi Arabia.

Meanwhile, crude shipments from the Middle East appear resilient after Saudi Arabia shut down its East‑West pipeline following attacks. JPMorgan analysts noted in a September 18 report that oil flows from the region remain surprisingly strong, averaging 17.1 million barrels per day over the past 10 days—about 6.1 million bpd below the 2025 average.

Potential supply disruptions persist. Trump told Fox that he is in a “deciding mode” and that “very big things” are expected soon regarding the U.S.–Iran conflict.

Prices are likely to stay closely linked to the pace of export normalization and diplomatic progress, said Daniel Takieddine, co‑founder and CEO of Sky Links Capital Group.

Any setback or renewed deterioration in shipping conditions would tighten the physical market and restore upward pressure on prices, Takieddine added.

Technologies

White House TV press pool won’t cover Trump after CNN ban

This is breaking news. Please refresh for updates.
Politics & Policy
White House TV press pool won’t cover Trump after CNN ban
This site is now part of Versant. By continuing to use this service, you agree to our Terms. You also acknowledge that our updated Privacy Policy…

This is breaking news. Please refresh for updates.

Politics & Policy

White House TV press pool won’t cover Trump after CNN ban

This site is now part of Versant. By continuing to use this service, you agree to our Terms. You also acknowledge that our updated Privacy Policy applies, including to your existing data. For details on your data rights, click here.

On this service, we and our vendors use cookies and other tools (“Cookies”) to store and access information on your device, such as device identifiers, IP address, and your browser type. You can access a list of all our potential 1021 vendors by selecting “IAB and Google Vendors,” although we may work with only a small selection of these on this service. Your data may be used to save and communicate your privacy choices; ensure security, prevent fraud, and debug our products and services; personalize advertising and content; for advertising and content measurement; to conduct audience research and services development; so we can improve our services and develop new ones; to match and combine offline data with your online activity; and for social features. We may share this data with select vendors with your consent.

Click “I Accept”, to consent to our use of these Cookies or “Reject All” to reject our use of these Cookies. Click “Manage Choices” to set your preferences. If you previously made choices with respect to Versant’s use of Cookies on this browser and device, you will need to update them. You can adjust your choices any time through the “Cookie Preferences” link in the footer of relevant Versant sites or in-app settings. Visit our Cookie Notice and Privacy Policy to learn more.

We will also use other Cookies that are essential or related to our services, including for security and fraud prevention.

Store and/or access information on a device. Personalised advertising and content, advertising and content measurement, audience research and services development.

– Your Privacy

– Strictly Necessary

– Save and communicate privacy choices 516 partners can use this special purpose

– Ensure security, prevent and detect fraud, and fix errors 651 partners can use this special purpose

– Deliver and present advertising and content 639 partners can use this special purpose

– Store and/or access information on a device 847 partners can use this purpose

– Personalised advertising and content, advertising and content measurement, audience research and services development 988 partners can use this purpose

– Targeted Advertising

– Content Selection

On this service, we and our vendors use cookies and other tools (“Cookies”) to store and access information on your device, such as device identifiers, IP address, and your browser type. Your data may be used to save and communicate your privacy choices; ensure security, prevent fraud, and debug our products and services; personalize advertising and content; for advertising and content measurement; to conduct audience research and services development; so we can improve our services and develop new ones; to match and combine offline data with your online activity; and for social features. We may share this data with select vendors with your consent. You can adjust your choices any time through the “Cookie Preferences” link in the footer of relevant Versant sites or in-app settings.

We will also use other Cookies that are essential or related to our services, including for security and fraud prevention. To learn more about some of our vendors, see the IAB and Google Vendors under each purpose. Visit our Cookie Notice and Privacy Policy to learn more.

Always Active

These Cookies and SDKs are required for Service functionality, including security and fraud prevention, and to enable any purchasing capabilities. You can set your browser to block these tracking technologies, but some parts of the site may not function properly.

The choices you make regarding the purposes and entities listed in this notice are saved and made available to those entities in the form of digital signals (such as a string of characters). This is necessary in order to enable both this service and those entities to respect such choices.

Your data can be used to monitor for and prevent unusual and possibly fraudulent activity (for example, regarding advertising, ad clicks by bots), and ensure systems and processes work properly and securely. It can also be used to correct any problems you, the publisher or the advertiser may encounter in the delivery of content and ads and in your interaction with them.

Certain information (like an IP address or device capabilities) is used to ensure the technical compatibility of the content or advertising, and to facilitate the transmission of the content or ad to your device.

Cookies, device or similar online identifiers (e.g. login-based identifiers, randomly assigned identifiers, network based identifiers) together with other information (e.g. browser type and information, language, screen size, supported technologies etc.) can be stored or read on your device to recognise it each time it connects to an app or to a website, for one or several of the purposes presented here.

– Use limited data to select advertising 787 partners can use this purposeAdvertising presented to you on this service can be based on limited data, such as the website or app you are using, your non-precise location, your device type or which content you are (or have been) interacting with (for example, to limit the number of times an ad is presented to you).

– Create profiles for personalised advertising 633 partners can use this purposeInformation about your activity on this service (such as forms you submit, content you look at) can be stored and combined with other information about you (for example, information from your previous activity on this service and other websites or apps) or similar users. This is then used to build or improve a profile about you (that might include possible interests and personal aspects). Your profile can be used (also later) to present advertising that appears more relevant based on your possible interests by this and other entities.

– Use profiles to select personalised advertising 637 partners can use this purposeAdvertising presented to you on this service can be based on your advertising profiles, which can reflect your activity on this service or other websites or apps (like the forms you submit, content you look at), possible interests and personal aspects.

– Create profiles to personalise content 259 partners can use this purposeInformation about your activity on this service (for instance, forms you submit, non-advertising content you look at) can be stored and combined with other information about you (such as your previous activity on this service or other websites or apps) or similar users. This is then used to build or improve a profile about you (which might for example include possible interests and personal aspects). Your profile can be used (also later) to present content that appears more relevant based on your possible interests, such as by adapting the order in which content is shown to you, so that it is even easier for you to find content that matches your interests.

– Use profiles to select personalised content 231 partners can use this purposeContent presented to you on this service can be based on your content personalisation profiles, which can reflect your activity on this or other services (for instance, the forms you submit, content you look at), possible interests and personal aspects. This can for example be used to adapt the order in which content is shown to you, so that it is even easier for you to find (non-advertising) content that matches your interests.

– Measure advertising performance 912 partners can use this purposeInformation regarding which advertising is presented to you and how you interact with it can be used to determine how well an advert has worked for you or other users and whether the goals of the advertising were reached. For instance, whether you saw an ad, whether you clicked on it, whether it led you to buy a product or visit a website, etc. This is very helpful to understand the relevance of advertising campaigns.

– Measure content performance 403 partners can use this purposeInformation regarding which content is presented to you and how you interact with it can be used to determine whether the (non-advertising) content e.g. reached its intended audience and matched your interests. For instance, whether you read an article, watch a video, listen to a podcast or look at a product description, how long you spent on this service and the web pages you visit etc. This is very helpful to understand the relevance of (non-advertising) content that is shown to you.

– Understand audiences through statistics or combinations of data from different sources 575 partners can use this purposeReports can be generated based on the combination of data sets (like user profiles, statistics, market research, analytics data) regarding your interactions and those of other users with advertising or (non-advertising) content to identify common characteristics (for instance, to determine which target audiences are more receptive to an ad campaign or to certain contents).

– Develop and improve services 683 partners can use this purposeInformation about your activity on this service, such as your interaction with ads or content, can be very helpful to improve products and services and to build new products and services based on user interactions, the type of audience, etc. This specific purpose does not include the development or improvement of user profiles and identifiers.

– Use limited data to select content 179 partners can use this purposeContent presented to you on this service can be based on limited data, such as the website or app you are using, your non-precise location, your device type, or which content you are (or have been) interacting with (for example, to limit the number of times a video or an article is presented to you).

These Cookies and SDKs are used to collect data about your browsing habits, use of the Services, your preferences, and your interaction with advertisements across platforms and devices for the purpose of delivering targeted advertising content, both on our Services and on third party sites. Third-party sites and services also use Targeting Cookies to deliver content, including advertisements relevant to your interests on the Services. If you reject these Cookies or SDKs, you will see less relevant advertising.

Data collected under this category through Cookies and SDKs can also be used to select and deliver personalized content, such as news articles and videos.

Consent Leg.Interest

label