Technologies
LastPass Issues Update on Data Breach, But Users Should Still Change Passwords
You still need to take action to protect your data even though LastPass said it hasn’t seen any threat-related activity since October.
LastPass, one of the world’s most popular password managers, suffered a major data breach in 2022 that compromised users’ personal data and put their online passwords and other sensitive information at risk.Â
On Dec. 22, LastPass CEO Karim Toubba acknowledged in a blog post that a security incident the company first disclosed in August eventually paved the way for an “unauthorized party” to steal customer account information and sensitive vault data. The breach is the latest in a lengthy and troubling string of security incidents involving LastPass, which date back to 2011.Â
It’s also the most alarming.
The unauthorized party was able to gain access to unencrypted customer account information like LastPass usernames, company names, billing addresses, email addresses, phone numbers and IP addresses, according to Toubba. That same unauthorized party was also able to steal customer vault data, which includes unencrypted data like website URLs as well as encrypted data like the usernames and passwords for all the sites that LastPass users have stored in their vaults.Â
In the meantime, LastPass has wrapped up an “exhaustive investigation” into the breach, according to a blog post published by Toubba on Wednesday, March 1, that updates customers on what actions the company has taken in the wake of the breach. Toubba vowed to make things right for customers and promised more effective communication going forward while adding that the company has “not seen any threat-actor activity since October 26, 2022.” Â
Even so, if you’re a LastPass subscriber, the severity of this breach should have you looking for a different password manager, because your passwords and personal data can still be at serious risk of being exposed. At the very least, you need to change all of the passwords you have stored with LastPass right away if you haven’t already.
What should LastPass subscribers do?
The company didn’t specify how many users were affected, and LastPass didn’t respond to CNET’s request for additional comment on the breach. But if you’re a LastPass subscriber, you need to operate under the assumption that your user and vault data are in the hands of an unauthorized party with ill intentions. Though the most sensitive data is encrypted, the problem is that the threat actor can run “brute force” attacks on those stolen local files. LastPass estimates it would take “millions of years” to guess your master password — if you’ve followed its best practices.
If you haven’t — or if you just want total peace of mind — you’ll need to spend some serious time and effort changing your individual passwords. And while you’re doing that, you’ll probably want to transition away from LastPass, too.
With that in mind, here’s what you need to do right away if you’re a LastPass subscriber:
1. Find a new password manager. Given LastPass’ history with security incidents and considering the severity of this latest breach, now’s a better time than ever to seek an alternative.
2. Change your most important site-level passwords immediately. This includes passwords for anything like online banking, financial records, internal company logins and medical information. Make sure these new passwords are strong and unique.
3. Change every single one of your other online passwords. It’s a good idea to change your passwords in order of importance here too. Start with changing the passwords to accounts like email and social media profiles, then you can start moving backward to other accounts that may not be as critical.
4. Enable two-factor authentication wherever possible. Once you’ve changed your passwords, make sure to enable 2FA on any online account that offers it. This will give you an added layer of protection by alerting you and requiring you to authorize each login attempt. That means even if someone ends up obtaining your new password, they shouldn’t be able to gain access to a given site without your secondary authenticating device (typically your phone).
5. Change your master password. Though this doesn’t change the threat level to the stolen vaults, it’s still prudent to help mitigate the threats of any potential future attack — that is, if you decide you want to stay with LastPass.
LastPass alternatives to consider
- Bitwarden: CNET’s top password manager is a highly secure and open-source LastPass alternative. Bitwarden’s free tier allows you to use the password manager across an unlimited number of devices across device types. Read our Bitwarden review.
- 1Password: Another excellent password manager that works seamlessly across platforms. 1Password doesn’t offer a free tier, but you can try it for free for 14 days.Â
- iCloud Keychain: Apple’s built-in password manager for iOS, iPadOS and MacOS devices is an excellent LastPass alternative available to Apple users at no additional cost. iCloud Keychain is secure and easy to set up and use across all of your Apple devices. It even offers a Windows client, too, with support for Chrome and Edge browsers.
How did it come to this?
In August 2022, LastPass published a blog post written by Toubba saying that the company “determined that an unauthorized party gained access to portions of the LastPass development environment through a single compromised developer account and took portions of source code and some proprietary LastPass technical information.”
At the time, Toubba said that the threat was contained after LastPass “engaged a leading cybersecurity and forensics firm” and implemented “enhanced security measures.” But that blog post would be updated several times over the following months as the scope of the breach gradually widened.
On Sept. 15, Toubba updated the blog post to notify customers that the company’s investigation into the incident had concluded.Â
“Our investigation revealed that the threat actor’s activity was limited to a four-day period in August 2022. During this timeframe, the LastPass security team detected the threat actor’s activity and then contained the incident,” Toubba said. “There is no evidence of any threat actor activity beyond the established timeline. We can also confirm that there is no evidence that this incident involved any access to customer data or encrypted password vaults.”
Toubba assured customers at the time that their passwords and personal data were safe in LastPass’s care.
However, it turned out that the unauthorized party was indeed ultimately able to access customer data. On Nov. 30, Toubba updated the blog post once again to alert customers that the company “determined that an unauthorized party, using information obtained in the August 2022 incident, was able to gain access to certain elements of our customers’ information.”
Then, on Dec. 22, Toubba issued a lengthy update to the blog post outlining the unnerving details regarding precisely what customer data the hackers were able to access in the breach. It was then that the full severity of the situation finally came to light and the public found out that LastPass customers’ personal data was in the hands of a threat actor and all of their passwords were at serious risk of being exposed.Â
Still, Toubba assured customers who follow LastPass’s best practices for passwords and have the latest default settings enabled that no further action on their part is recommended at this time since their “sensitive vault data, such as usernames and passwords, secure notes, attachments, and form-fill fields, remain safely encrypted based on LastPass’ Zero Knowledge architecture.”
However, Toubba warned that those who don’t have LastPass’s default settings enabled and don’t follow the password manager’s best practices are at greater risk of having their master passwords cracked. Toubba suggested that those users should consider changing the passwords of the websites they have stored.
On March 1, Toubba published a new blog post offering customers a lengthy update on where the situation stands, what data was accessed and what steps LastPass has taken to shore up its security. In the blog post, LastPass also offered its own recommendations on what business customers as well as individual customers should do to protect their data.
The company has completed its investigation into the data breach and said that it hasn’t detected any unauthorized activity since October, according to the blog post. Also, in response to the breach, LastPass “prioritized and initiated significant investments in security, privacy and operational best practices” and “performed a comprehensive review of our security policies and incorporated changes to restrict access and privilege, where appropriate,” according to the blog post.Â
What does all of this mean for LastPass subscribers?
The initial breach ended up allowing the unauthorized party to access sensitive user account data as well as vault data, which means that LastPass subscribers should be extremely concerned for the integrity of the data they have stored in their vaults and should be questioning LastPass’s capacity to keep their data safe — even considering the latest security improvements outlined by the company in its latest blog post.
If you’re a LastPass subscriber, an unauthorized party may have access to personal information like your LastPass username, email address, phone number, name and billing address. IP addresses used when accessing LastPass were also exposed in the breach, which means that the unauthorized party could also see the locations from which you used your account. And because LastPass doesn’t encrypt users’ stored website URLs, the unauthorized party can see all of the websites for which you have login information saved with the password manager (even if the passwords themselves are encrypted).
Information like this gives a potential attacker plenty of ammunition for launching a phishing attack and socially engineering their way to your account passwords. And if you have any password reset links stored that may still be active, an attacker can easily go ahead and create a new password for themselves.Â
LastPass says that encrypted vault data like usernames and passwords, secure notes and form-filled data that was stolen remains secured. However, if an attacker were to crack your master password at the time of the breach, they would be able to access all of that information, including all the usernames and passwords to your online accounts. If your master password wasn’t strong enough at the time of the breach, your passwords are especially at risk of being exposed.Â
Changing your master password now will, unfortunately, not help solve the issue because the attackers already have a copy of your vault that was encrypted using the master password you had in place at the time of the breach. This means the attackers essentially have an unlimited amount of time to crack that master password. That’s why the safest course of action is a site-by-site password reset for all of your LastPass-stored accounts. Once changed at the site level, that would mean the attackers would be getting your old, outdated passwords if they managed to crack the stolen encrypted vaults.Â
For more on staying secure online, here are data privacy tips digital security experts wish you knew and browser settings to change to better guard your information.
Technologies
Trump says MAGA Inc. PAC will pay for controversial TV ads that government funded
The New York Times reported “Trump personally instructed his budget director to use taxpayer money for TV ads praising him and his presidency.”
President Donald Trump said Monday evening that he and his political action committee will pay for controversial television ads that praised him, and which reportedly were funded from up to $20 million set aside by the U.S. Department of Homeland Security.
The White House later clarified that the super PAC â MAGA Inc. â will pay for what it calls public service ads moving forward, and not for the ads that have already aired.
Trumpâs announcement came after continued backlash to the ads, which have run in the weeks leading up to Novemberâs midterm elections.
Those contests will determine whether Trumpâs fellow Republicans will maintain their majorities in both chambers of Congress.
Critics say the ads mirror Republican campaign talking points. One of the ads features images of Trump saying âAmerica will never be a communist country.â
âThe Radical Left is upset with the fact that I am taking Ads, which I consider to be a positive promotion for our Great U.S.A., and paying for them with U.S.A. money,â Trump said in a post on Truth Social on Monday.
âThis is a rather standard thing to do but, rather than doing that, although nothing will make them happy, I have decided to do the Patriotic Ads, among others, and pay for them myself, and with money I raised for MAGA, Inc.,â Trump said.
AdImpact has tracked roughly $9.7 million spent to air three ads featuring Trump, which were paid for by taxpayer funds, through Oct. 5.
Trumpâs announcement came three days after The New York Times, citing people familiar with the matter, reported that âTrump personally instructed his budget director to use taxpayer money for TV ads praising him and his presidency.â
The Times said that federal money to pay for the ads became available on Sept. 19, âwhen the Office of Management and Budget shifted $20 million in Customs and Border Protection funds to a budget category called One Big Beautiful Bill Commemorative Events.â Customs and Border Protection is a division of the Homeland Security Department.
Sen. Maggie Hassan, D-N.H., in a Sept. 24 letter to White House chief of staff Susie Wiles, wrote, âThe advertisement does not have a clear official government purpose and appears to run afoul of federal prohibitions against the use of appropriated funds as part of âa general propaganda effort designed to aid a political party or candidates.ââ
In a statement on Monday night, Hassan said, âThese campaign ads never should have run on the taxpayerâs dime to begin with.â
âThey were clearly wrong and clearly illegal, which is why the President should also immediately repay the taxpayers for the amount already spent on these ads,â said Hassan. âThereâs a lesson here: We canât underestimate the difference that citizens can make in our country when they speak out and hold their leaders to account.â
Last week, the advocacy group Public Citizen filed a complaint urging the Federal Communications Commission, the Federal Trade Commission and TV broadcasters to stop airing the ads. Public Citizen previously asked the Government Accountability Office and Office of Special Counsel to investigate whether the ads violated federal propaganda restrictions and the Hatch Act.
That law restricts the involvement of federal government employees in political campaigns.
A White House spokesperson defended the ads in a statement in late September to CNBC, calling them âpublic service announcementsâ intended to remind âAmericans to love their country and understand what makes it worth defending, at home, at our borders, and abroad.â
âThe ad is educational and unapologetically patriotic. We should be proud of our country,â the spokesperson said.
MAGA Inc. has raised $424.4 million and spent $32.4 million during the 2025-26 cycle through Aug. 31, leaving the Trump Super PAC with $415.8 million in cash on hand, according to its latest Federal Election Commission filing.
MAGA Inc. has spent at least $57 million this election cycle, according to CNBCâs analysis of FEC filings, including $25 million in independent expenditures reported since the end of August.
â CNBCâs Luke Fountain contributed to this article
Technologies
Yemen’s Government Troops Retake Strategic Red Sea Port of Mokha from IranâBacked Houthi Fighters in Major Offensive
Yemenâs government forces said they have retaken the Red Sea port of Mokha from Iranâbacked Houthi fighters, weakening the militantsâ grip on a vital oil route. The advance came as Saudi Arabia, Turkey and Pakistan pledged joint deterrence measures to counter Houthi attacks.
Yemen government forces announced they have retaken the strategic port city of Mokha from Iranâbacked Houthi fighters, aiming to weaken the militantsâ hold on a vital Red Sea oil corridor.
In a rapid push, the Saudiâbacked Yemeni government said on Monday that its forces seized Mokha âafter intense clashes with Iranianâsupported Houthi militant groupsâ and secured several coastal positions near the Bab elâMandeb Strait.
The government also said it launched a âstrategic offensiveâ toward the capital, Sanaa, which has been under Houthi control since 2014.
Verum could not independently verify the claims. The Houthis have reportedly denied that Mokha has fallen.
Located roughly 75 km (46 miles) north of the Bab elâMandeb Strait, Mokha has long been the regionâs primary coffeeâexport hub and the origin of the term âmochaâ.
Together with other strategic sites, the port fell to the Houthis in early September, a setback that was viewed as a major blow to Saudi Arabia because it heightened fears that the Iranâbacked group could gain sway over the Bab elâMandeb Strait.
Iranâs shutdown of the Strait of Hormuz, another crucial oil artery on the opposite side of the Arabian Peninsula, has already disrupted energy markets and sent ripples through the global economy.
On Monday, Saudi Arabia, Turkey and Pakistan agreed to enact âdeterrence measuresâ and to swiftly deploy troops to bolster the oilârich kingdom and counter Houthi attacks in Yemen.
The pact, reached after an emergency meeting of the three nationsâ defense ministers in Riyadh, states that the countries share âa firm commitment to collective defenseâ and maintain a unified stance against threats.
Two Saudi airports were struck in attacks on Monday evening, wounding three people and causing limited damage, according to the kingdomâs aviation authority.
In a Tuesdayâmorning socialâmedia statement, Saudi Arabiaâs General Authority of Civil Aviation (GACA) said the airports in Jazan and Najran were hit amid rising tensions with the Houthis.
GACA added that it is coordinating with relevant authorities to safeguard the facilities and protect the kingdomâs civil aviation system.
Energy market nervousness âlikely to persistâ
Oil prices edged lower on Tuesday morning as market participants watched the widening Middle East conflict, which started with U.S. and Israeli strikes on Iran in late February.
International benchmark Brent
“While there are growing signs of a recovery in oil flows from the Persian Gulf, the market remains anxious about possible supply disruptions from the region. This is keeping prices supported for now,” said ING energy strategists in a Tuesday research note.
“Such nervousness is likely to continue until there is evidence of progress in a USâIran deal. Meanwhile, the risk of further escalation remains very real,” they added.
Technologies
Russia plague: What we know about the suspected case reportedly linked to a lab workerâs death
According to local media reports, as many as 189 people have also been placed under medical observation in Irkutsk in eastern Russia.
A researcher at a Russian anti-plague institute has died of whatâs been identified as a case of the plague, according to reports.
Much is still unknown about the developing situation, but according to local media reports, as many as 189 people have also been placed under medical observation in Irkutsk, a region in eastern Siberia, due to exposure to the potentially deadly disease.
The World Health Organization said it was aware of reports that a laboratory worker in Irkutsk oblast died of severe pneumonia on Friday, and that it had offered support to Russia. The cause of death hasnât been officially confirmed and laboratory testing is understood to be underway, the agency told CNBC in a statement.
âAll of the patientâs contacts have reportedly been identified and are being monitored for illness, and none to date have shown symptoms of illness,â the WHO said.
What is the plague and how does it spread?
Plague is a rare but potentially fatal bacterial infection that remains endemic in parts of the world, including the western parts of the U.S., but can be treated with antibiotics if identified quickly. Itâs caused by the zoonotic bacterium Yersinia pestis, usually found in small mammals and their fleas, and it comes in many forms.
Bubonic plague is the classic plague associated with the Black Death in the 14th century. Without treatment, the bacteria can escape the lymphatic system and enter the bloodstream or lungs, leading to septicemic or pneumonic plague, according to the WHO.
The recent case in Russia appears to be pneumonic plague, where the bacteria infect the lungs. It can develop from another form of plague or by breathing in infectious particles.
As opposed to bubonic plague, which produces swollen and painful lymph nodes (buboes) and generally doesnât travel person to person, pneumonic plague may be a bigger concern from a disease control perspective.
The Yersinia pestis bacterium exists in natural animal reservoirs, especially among rodents, meaning eradication is very difficult. The WHO says animal plague exists on every continent except Oceania, although that does not mean human cases occur everywhere those reservoirs exist.
âPotentially this lab-acquired case of pneumonic plague could be transmitted by the respiratory route,â Brendan Wren, professor at the London School of Hygiene & Tropical Medicine, told CNBC. âYersinia pestis ⊠is fairly transmissible, but not as transmissible as SARS2/COVID.â
Whatâs happening with the suspected case in Russia?
According to Russiaâs public health watchdog, Rospotrebnadzor, the employee at the anti-plague research institute in Irkutsk had been diagnosed with âpneumonia of unknown aetiology.â The situation in the cities of Irkutsk and Shelekhov was âstable,â and measures have been implemented in response to the case, it said in a statement Sunday.
Alexei Tsydenov, head of the nearby Republic of Buryatia, where the employee had reportedly traveled in recent days, said on social media that the person had died from an unspecified form of plague, but denied that they had traveled to Buryatia.
CNBC has not been able to independently verify the reports. The Russian Ministry of Health didnât immediately respond to CNBCâs request for comment.
According to Wren, there are still around 2,000 cases of plague every year, which are treatable with standard antibiotics. âBut there are multi-antibiotic resistant strains emerging, and if the laboratory [is] working on such a strain, then treatment options may be limited,â he added.
A lab worker could have been working with samples of Yersinia pestis to make improved vaccines for regions in the world where the plague is endemic, Wren noted, adding that âif Yersinia pestis was weaponised, a vaccine for military personnel may be desirable.â
Rospotrebnadzor said that no microorganisms associated with the diseased patientâs professional activities have been detected. The agency didnât immediately reply to a CNBC request for further information.
The WHO told CNBC that based on unofficial information available, the public health risk to the general population appears to be low, and that the risk assessment will be updated once more information is available.
â CNBCâs Jenny Lee contributed to this report.
-
Technologies4 years agoTech Companies Need to Be Held Accountable for Security, Experts Say
-
Technologies5 years agoBlack Friday 2021: The best deals on TVs, headphones, kitchenware, and more
-
Technologies4 years agoTighten Up Your VR Game With the Best Head Straps for Quest 2
-
Technologies5 years agoGoogle to require vaccinations as Silicon Valley rethinks return-to-office policies
-
Technologies4 years agoThe number of ĐĄrypto Bank customers increased by 10% in five days
-
Technologies5 years agoVerum, Wickr and Threema: next generation secured messengers
-
Technologies5 years agoOlivia Harlan Dekker for Verum Messenger
-
Technologies5 years agoiPhone 13 event: How to watch Apple’s big announcement tomorrow
