Technologies

LastPass Issues Update on Data Breach, But Users Should Still Change Passwords

You still need to take action to protect your data even though LastPass said it hasn’t seen any threat-related activity since October.

LastPass, one of the world’s most popular password managers, suffered a major data breach in 2022 that compromised users’ personal data and put their online passwords and other sensitive information at risk.

On Dec. 22, LastPass CEO Karim Toubba acknowledged in a blog post that a security incident the company first disclosed in August eventually paved the way for an «unauthorized party» to steal customer account information and sensitive vault data. The breach is the latest in a lengthy and troubling string of security incidents involving LastPass, which date back to 2011.

It’s also the most alarming.

The unauthorized party was able to gain access to unencrypted customer account information like LastPass usernames, company names, billing addresses, email addresses, phone numbers and IP addresses, according to Toubba. That same unauthorized party was also able to steal customer vault data, which includes unencrypted data like website URLs as well as encrypted data like the usernames and passwords for all the sites that LastPass users have stored in their vaults.

In the meantime, LastPass has wrapped up an «exhaustive investigation» into the breach, according to a blog post published by Toubba on Wednesday, March 1, that updates customers on what actions the company has taken in the wake of the breach. Toubba vowed to make things right for customers and promised more effective communication going forward while adding that the company has «not seen any threat-actor activity since October 26, 2022.»

Even so, if you’re a LastPass subscriber, the severity of this breach should have you looking for a different password manager, because your passwords and personal data can still be at serious risk of being exposed. At the very least, you need to change all of the passwords you have stored with LastPass right away if you haven’t already.

What should LastPass subscribers do?

The company didn’t specify how many users were affected, and LastPass didn’t respond to CNET’s request for additional comment on the breach. But if you’re a LastPass subscriber, you need to operate under the assumption that your user and vault data are in the hands of an unauthorized party with ill intentions. Though the most sensitive data is encrypted, the problem is that the threat actor can run «brute force» attacks on those stolen local files. LastPass estimates it would take «millions of years» to guess your master password — if you’ve followed its best practices.

If you haven’t — or if you just want total peace of mind — you’ll need to spend some serious time and effort changing your individual passwords. And while you’re doing that, you’ll probably want to transition away from LastPass, too.

With that in mind, here’s what you need to do right away if you’re a LastPass subscriber:

1. Find a new password manager. Given LastPass’ history with security incidents and considering the severity of this latest breach, now’s a better time than ever to seek an alternative.

2. Change your most important site-level passwords immediately. This includes passwords for anything like online banking, financial records, internal company logins and medical information. Make sure these new passwords are strong and unique.

3. Change every single one of your other online passwords. It’s a good idea to change your passwords in order of importance here too. Start with changing the passwords to accounts like email and social media profiles, then you can start moving backward to other accounts that may not be as critical.

4. Enable two-factor authentication wherever possible. Once you’ve changed your passwords, make sure to enable 2FA on any online account that offers it. This will give you an added layer of protection by alerting you and requiring you to authorize each login attempt. That means even if someone ends up obtaining your new password, they shouldn’t be able to gain access to a given site without your secondary authenticating device (typically your phone).

5. Change your master password. Though this doesn’t change the threat level to the stolen vaults, it’s still prudent to help mitigate the threats of any potential future attack — that is, if you decide you want to stay with LastPass.

LastPass alternatives to consider

Bitwarden: CNET’s top password manager is a highly secure and open-source LastPass alternative. Bitwarden’s free tier allows you to use the password manager across an unlimited number of devices across device types. Read our Bitwarden review.
1Password: Another excellent password manager that works seamlessly across platforms. 1Password doesn’t offer a free tier, but you can try it for free for 14 days.
iCloud Keychain: Apple’s built-in password manager for iOS, iPadOS and MacOS devices is an excellent LastPass alternative available to Apple users at no additional cost. iCloud Keychain is secure and easy to set up and use across all of your Apple devices. It even offers a Windows client, too, with support for Chrome and Edge browsers.

How did it come to this?

In August 2022, LastPass published a blog post written by Toubba saying that the company «determined that an unauthorized party gained access to portions of the LastPass development environment through a single compromised developer account and took portions of source code and some proprietary LastPass technical information.»

At the time, Toubba said that the threat was contained after LastPass «engaged a leading cybersecurity and forensics firm» and implemented «enhanced security measures.» But that blog post would be updated several times over the following months as the scope of the breach gradually widened.

On Sept. 15, Toubba updated the blog post to notify customers that the company’s investigation into the incident had concluded.

«Our investigation revealed that the threat actor’s activity was limited to a four-day period in August 2022. During this timeframe, the LastPass security team detected the threat actor’s activity and then contained the incident,» Toubba said. «There is no evidence of any threat actor activity beyond the established timeline. We can also confirm that there is no evidence that this incident involved any access to customer data or encrypted password vaults.»

Toubba assured customers at the time that their passwords and personal data were safe in LastPass’s care.

However, it turned out that the unauthorized party was indeed ultimately able to access customer data. On Nov. 30, Toubba updated the blog post once again to alert customers that the company «determined that an unauthorized party, using information obtained in the August 2022 incident, was able to gain access to certain elements of our customers’ information.»

Then, on Dec. 22, Toubba issued a lengthy update to the blog post outlining the unnerving details regarding precisely what customer data the hackers were able to access in the breach. It was then that the full severity of the situation finally came to light and the public found out that LastPass customers’ personal data was in the hands of a threat actor and all of their passwords were at serious risk of being exposed.

Still, Toubba assured customers who follow LastPass’s best practices for passwords and have the latest default settings enabled that no further action on their part is recommended at this time since their «sensitive vault data, such as usernames and passwords, secure notes, attachments, and form-fill fields, remain safely encrypted based on LastPass’ Zero Knowledge architecture.»

However, Toubba warned that those who don’t have LastPass’s default settings enabled and don’t follow the password manager’s best practices are at greater risk of having their master passwords cracked. Toubba suggested that those users should consider changing the passwords of the websites they have stored.

On March 1, Toubba published a new blog post offering customers a lengthy update on where the situation stands, what data was accessed and what steps LastPass has taken to shore up its security. In the blog post, LastPass also offered its own recommendations on what business customers as well as individual customers should do to protect their data.

The company has completed its investigation into the data breach and said that it hasn’t detected any unauthorized activity since October, according to the blog post. Also, in response to the breach, LastPass «prioritized and initiated significant investments in security, privacy and operational best practices» and «performed a comprehensive review of our security policies and incorporated changes to restrict access and privilege, where appropriate,» according to the blog post.

What does all of this mean for LastPass subscribers?

The initial breach ended up allowing the unauthorized party to access sensitive user account data as well as vault data, which means that LastPass subscribers should be extremely concerned for the integrity of the data they have stored in their vaults and should be questioning LastPass’s capacity to keep their data safe — even considering the latest security improvements outlined by the company in its latest blog post.

If you’re a LastPass subscriber, an unauthorized party may have access to personal information like your LastPass username, email address, phone number, name and billing address. IP addresses used when accessing LastPass were also exposed in the breach, which means that the unauthorized party could also see the locations from which you used your account. And because LastPass doesn’t encrypt users’ stored website URLs, the unauthorized party can see all of the websites for which you have login information saved with the password manager (even if the passwords themselves are encrypted).

Information like this gives a potential attacker plenty of ammunition for launching a phishing attack and socially engineering their way to your account passwords. And if you have any password reset links stored that may still be active, an attacker can easily go ahead and create a new password for themselves.

LastPass says that encrypted vault data like usernames and passwords, secure notes and form-filled data that was stolen remains secured. However, if an attacker were to crack your master password at the time of the breach, they would be able to access all of that information, including all the usernames and passwords to your online accounts. If your master password wasn’t strong enough at the time of the breach, your passwords are especially at risk of being exposed.

Changing your master password now will, unfortunately, not help solve the issue because the attackers already have a copy of your vault that was encrypted using the master password you had in place at the time of the breach. This means the attackers essentially have an unlimited amount of time to crack that master password. That’s why the safest course of action is a site-by-site password reset for all of your LastPass-stored accounts. Once changed at the site level, that would mean the attackers would be getting your old, outdated passwords if they managed to crack the stolen encrypted vaults.

For more on staying secure online, here are data privacy tips digital security experts wish you knew and browser settings to change to better guard your information.

Technologies

The Apple Watch Series 11 Could Share the Stage at Next Week’s Event

The Series 11 will likely headline, but rumors and iOS clues point to additional models joining the lineup at Apple’s September 9 launch event.

All eyes are on Apple’s September 9 «Awe Dropping» event, where a fresh batch of Apple Watches is expected to take center stage alongside the new iPhone 17 lineup. While the Series 11 will almost certainly headline, Apple may have already tipped its hand on the next Ultra. Imagery found in the iOS 26 public beta (first spotted by MacRumors ) shows display specs that don’t match any current model, and the two-year update cycle only strengthens the case that the rugged Apple Watch Ultra 3 is on the horizon.

With the clues stacking up, here’s a look at everything we know, suspect and can reasonably expect from Apple’s 2025 smartwatch lineup.

Don’t miss any of our unbiased tech content and lab-based reviews. Add CNET as a preferred Google source.

How many Apple Watches will we get?

Based on the usual update cycle and now the latest clues in iOS 26, we’re at least getting a flagship (Series 11) and an Apple Watch Ultra 3 as revealed by a reference in Watch OS 26. Also likely is the possibility of getting a next-gen SE model, according to a report from Bloomberg’s Apple analyst Mark Gurman. The Apple Watch Ultra and the cheaper SE line haven’t exactly followed a predictable upgrade cycle but last year’s absence could prove a strong clue that 2025 could be the year that we get all three again.

According to Gurman, the new Ultra and Series 11 are mostly expected to look the same, while the SE could get a refreshed exterior. The Ultra could also get satellite connectivity and 5G RedCap network access that would bring even the most remote adventures «on the grid.»

Apple Watch Series 11 price and availability

Traditionally, new models go on sale anywhere from a few days to a couple of weeks after the keynote. This year, that could mean preorders opening on Friday, Sept. 12, with availability starting the following Friday, Sept. 19. That said, recent years have seen delays because of production issues and it’s still unclear how newly imposed tariffs might affect the launch timing and pricing in 2025. For context: the Series 10 starts at $399 for the base model, while the Ultra 2 comes in at $799. The other question is what the most expensive variant will be — solid gold, diamond-encrusted Hermès, anyone?

Apple Watch Series 11 design

The Series 11 is expected to keep the slim, flat-edged design introduced on the Series 10 (42mm and 46mm), but Apple’s new Corning partnership means all of the glass protecting the display will be made in the US. Not only does the news make for a great marketing bullet; it could also hint at improved durability, sustainability benefits and, potentially, faster repair turnarounds if replacement glass is sourced domestically.

If the leaked iOS 26 imagery holds true, the Ultra 3 will also have a similar design and slightly larger screen with a 422×514-pixel resolution (up from the Ultra 2’s 410×502 pixels). This could be achieved by slimming down the bezels while keeping the same overall case size, in keeping with Apple’s tradition of maximizing screen real estate without making the already-large Ultra any bulkier.

According to MacRumors, the Apple Watch could also get a more energy-efficient screen, maybe an improved LTPO display with higher resolution and better brightness, which, on paper, could help improve the battery life. This could be reserved for the higher-end Ultra 3, which will likely otherwise keep its original design.

Meanwhile the more affordable SE could see a more extensive design overhaul; it would keep the body of the Series 8 and, according to Gurman, get several upgrades from the Series 10, like an always-on display.

Apple Watch Series 11 processor

Apple typically bumps up the processor with every new smartwatch, so we should see an Apple S11 chip this time around for at least the Series 11 and Ultra 3. The Ultra 3 is also rumored to get satellite connectivity and 5G support, but according to Gurman, these features likely won’t make it to the Series 11. Considering last gen’s upgrade cycle, my personal bet would also be on the SE getting a processor bump up to the S9 chip, currently found in the Ultra 2 and the Apple Watch Series 9.

Apple Watch Series 11 battery

If there’s one thing on everyone’s wishlist, it’s better battery life. The Series 10 introduced faster charging — 0% to 80% in just 30 minutes compared with 90 minutes on previous models — but there’s room for improvement in battery capacity itself.

While there aren’t any rumors indicating that new Apple Watches will get a longer battery life, I truly hope Apple addresses the battery because its smartwatches are falling behind. Some Android models use dual chipsets to divide tasks and optimize battery life. I’d like to see Apple adopt a similar strategy and finally push battery life to two full days on a single charge for regular models. I hope the Ultra, which currently gets a full 72 hours on a charge, gets the faster charging of the Series 10 and pushes its battery life limits beyond three days.

Apple Watch health and fitness upgrades

There’s been a persistent rumor about blood pressure tracking finally making its way to the Apple Watch, but it’s unclear when it will be ready. According to a March report from Gurman, Apple has already been testing the feature in its smartwatch but has run into problems. Other wearables health companies like Omron and Med-Watch have proven it’s possible to measure blood pressure from the wrist, but adding this feature would likely require new sensors and a bulkier design. It would also be less precise than dedicated health devices like Omron’s and measure baseline metrics like the Galaxy Watch 7 and Ultra (which isn’t supported on Samsung watches in the US).

Blood pressure and glucose monitoring have also been thrown in the mix but the latter might not be fully baked for this cycle, according to Gurman.

A WatchOS glow-up on the Series 11

Apple also gave us a preview of the new interface for the Apple Watch with WatchOS 26 at its developers conference in June. The new UI update includes a new «Liquid Glass» display with glassy, transparent design language that mimics the one seen in visionOS.

The redesign features clear overlays for icons and notifications, resulting in a more uniform look and feel across Apple’s ecosystem. Google made a similar move with its redesigned UI, Material 3 Expressive, for Android phones and smartwatches with Wear OS 6.

Want a full breakdown of everything Apple announced, including the new iOS 26 and its eye-catching Liquid Glass design? Here’s everything you missed at WWDC 2025.

Health and fitness coaching

WatchOS 26 also introduced an AI-powered Workout Buddy to the Apple Watch, offering encouragement and real-time feedback during specific workouts. Most of the heavy lifting will happen on the iPhone, meaning the feature requires pairing the watch with a newer Apple Intelligence-enabled iPhone. The Series 11 (and Ultra 3) could push this further by leveraging their more powerful chipset.

This could include coaching that goes beyond just the workout app, potentially debuting on the Series 11 and then also rolling out to compatible Apple Watches. According to Gurman, Apple has been working on a major Health app revamp, code-named Project Mulberry, that would bring AI recommendations and actionable health and fitness insights to users. The new «Health Plus» app would likely arrive as part of an iOS 19 update, working in tandem with WatchOS 11 to gather and process data.

Health coaching is something other competitors, like Garmin and Fitbit, offer through their platforms via premium (paid) subscriptions. It’s not clear whether Apple would charge extra for these features, or if they’d be baked into the standard Health app at no additional cost.

Additional future Apple Watch surprises

There’s another rumor floating around that the Apple Watch could get a camera — not for selfies, but for AI-based image recognition. With the release of Apple Intelligence, Apple introduced a visual search tool on the iPhone that uses the camera to provide relevant information about objects and places.

According to a report by Gurman, Apple is exploring this option, and even if the company decides to move forward with the technology, it likely wouldn’t make its way to the Apple Watch until the 2027 models. While it’s not expected for this launch, it could hint what kind of AI integration will arrive with WatchOS 12. By contrast, WatchOS 11 lacks any Apple Intelligence features.

An even further-fetched clue hints at a foldable Apple Watch with two cameras. A recent Apple patent, first uncovered by Patently Apple, and published by the US Patent and Trademark Office in March, details an Apple Watch design featuring a foldable screen and another with a dual-screen display that either folds or slides out. The additional screens could give the Apple Watch more real estate to expand its functionality and make it less reliant on the iPhone. The same patent also points to the possibility of two cameras on this dual-screened watch for either AI processing or video calls. Apple often files patents well before any related technology appears in an actual product, so even if this concept does live to see the light of day, we’re not expecting it to make its public debut anytime soon.

Technologies

Major Amazon Prime Benefit Faces Crackdown Next Month

Amazon plans to end its Prime Invitee program soon. Here’s how this could affect your deliveries.

If you’re using a friend or family member’s free Prime shipping and you don’t live in the same household, you might need to pay another monthly cost. According to Amazon’s updated customer service page, first reported by The Verge, the retail giant is ending its Prime Invitee benefit-sharing program on Oct. 1.

Amazon isn’t the first company to prevent membership sharing between family and friends. The e-commerce giant is just the latest to follow Netflix’s account-sharing crackdown. We also saw it done with Disney-Plus last year. While it’s unclear whether this change will work for Amazon, Netflix gained over 200,000 subscribers following its policy change.

Don’t miss any of our unbiased tech content and lab-based reviews. Add CNET as a preferred Google source.

Amazon’s Prime Invitee program is being replaced by Amazon Family, which includes many of the same benefits. However, Amazon Family only works for up to two adults and four children living in the same «primary residential address» — a shared home. While you’ll still be able to use free shipping to send gifts elsewhere, your Prime Invitees will no longer be able to use the perk.

Read more: More Than Just Free Shipping: Here Are 19 Underrated Amazon Prime Perks

What this means for you

If you’re the beneficiary of someone else’s Prime Invitee benefits, you have one more month to take advantage of the current program before the changes take effect.

Starting in October, you’ll have to get your own Amazon Prime subscription in order to benefit from the company’s free shipping program. First-time subscribers get a year of Prime membership for $15, but you’ll be stuck shelling out $15 a month to maintain your subscription thereafter.

Read more: Your Free Pass to Prime Day Deals (No Membership Required)

Why is Amazon ending the Prime Invitee program?

This move follows shortly after Reuters reported that Amazon’s Prime account signups slowed down recently despite an extended July Prime Day event. While the company reported blowout sales numbers, new Prime subscriptions didn’t meet internal expectations. In the US, they fell short of last year’s signup metrics.

According to Reuters, Amazon registered 5.4 million US signups over the 21-day run-up to the Prime Day event, around 116,000 fewer than during the same period in 2024, and 106,000 below the company’s own goal, a roughly 2% decline in both metrics.

By forcing separate households to have their own subscriptions, Amazon could be looking to attract more Prime accounts after previously failing to do so.

The new Amazon Family program (previously known as Amazon Household) offers Prime benefits to up to two adults and four children in a single home, including free shipping, Prime Video, Prime Reading, Amazon Music and more. The subscription also includes benefits for certain third-party companies, such as GrubHub.

Impulse Buys Under $25 on Amazon That Make Surprisingly Great Gifts

+17 More

See all photos

Technologies

Premiere Pro for Free: How Adobe’s New iPhone App Will Let You Edit Videos at No Cost

Adobe Premiere users will only have to pay for extra AI credits and cloud storage.

Thanks to social media apps like TikTok and Instagram, everyone is an video editor these days. And soon you won’t have to sit down at a laptop to use one of the most popular video editors on the market.

Adobe announced on Thursday that it is releasing a new video editing iPhone app named Premiere on Sept. 30. You can preorder the app now in the Apple App Store, with an Android app currently in development.

The iOS app should feel familiar to Premiere users, with its multitrack timeline and preview screen. The app can be used for all your usual video editing: trimming clips, overlaying audio and adding synchronized captions. You can also use Adobe’s new voice-to-sound effects tool and record voiceovers.

Premiere should be a big upgrade for Adobe users who have only used Premiere Rush, a barebones version of its video editor. As more content creators become mobile-first, Adobe is hoping to draw them in with revamped mobile apps.

Don’t miss any of our unbiased tech content and lab-based reviews. Add CNET as a preferred Google source.

You should be able to use the Premiere iOS app for free. Adobe says you may need to pay for generative AI credits and additional storage, like through Adobe Creative Cloud, though more pricing info is expected closer to the Sept. 30 launch. This is very different from the desktop app, which starts at $23 per month.

A truly free Premiere mobile app would be a win for content creators, especially for anyone who wants to explore editing in Premiere but doesn’t want to pay for another subscription.

In an era of mobile-first content creators, tech companies have raced to introduce user-friendly mobile editing apps. TikTok creators use the ever-popular CapCut, with Meta adding its own contribution, a new app called Edits. Adobe has long been the industry standard for professional content creation and editing, but its mobile offerings were usually less feature-packed versions of its flagship programs under different names.

That changed this year as Adobe released true mobile versions of Photoshop and Firefly AI. The new Premiere app helps Adobe make a competitive entrance in a crowded market, in addition to giving loyal Adobe users a new way to access their tools on the go.

Adobe has also been focused on integrating generative AI into its software. Premiere Pro got its first-ever AI tool, generative extend, which uses AI to add a few extra seconds to clips you upload. It’s meant to help smooth transitions between clips, particularly when you might have turned off the recording a smidge too early and need a few extra seconds of film.

AI is a contentious issue among creators, with some voicing concerns over the training and deployment of AI models. Adobe’s Firefly AI has been fully integrated into the new Premiere iOS app, though the company’s AI guidelines state that it never trains on customer data and that its AI-generated content is commercially safe.

For more, check out what to know about the iOS and Android Photoshop apps and good alternatives to CapCut.