Hackers Had Access to LastPass’s Development Systems for Four Days

Share:

Password management solution LastPass shared more details pertaining to the security incident last month, disclosing that the threat actor had access to its systems for a four-day period in August 2022.

“There is no evidence of any threat actor activity beyond the established timeline,” LastPass CEO Karim Toubba said in an update shared on September 15, adding, “there is no evidence that this incident involved any access to customer data or encrypted password vaults.”

LastPass in late August revealed that a breach targeting its development environment resulted in the theft of some of its source code and technical information, although no further specifics were offered.

 

The company, which said it completed the probe into the hack in partnership with incident response firm Mandiant, noted the access was achieved using a developer’s compromised endpoint.

While the exact method of initial entry remains “inconclusive,” LastPass noted the adversary abused the persistent access to “impersonate the developer” after the victim had been authenticated using multi-factor authentication.

The company reiterated that despite the unauthorized access, the attacker failed to obtain any sensitive customer data owing to the system design and zero trust controls put in place to prevent such incidents.

This includes the complete separation of development and production environments and its own inability to access customers’ password vaults without the master password set by the users.

“Without the master password, it is not possible for anyone other than the owner of a vault to decrypt vault data,” Toubba pointed out.

Additionally, it also said it conducted source code integrity checks to look for any signs of poisoning and that developers do not possess the requisite permissions to push source code directly from the development environment into production.

Last but not least, LastPass noted that it has engaged the services of a “leading” cybersecurity firm to enhance its source code safety practices and that it has deployed additional endpoint security guardrails to better detect and prevent attacks aimed at its systems.

https://thehackernews.com/2022/09/hackers-had-access-to-lastpasss.html?

Leave a Comment

Your email address will not be published. Required fields are marked *

loader-image
London, GB
11:44 pm, Jul 6, 2025
weather icon 17°C
L: 16° | H: 18°
scattered clouds
Humidity: 72 %
Pressure: 1007 mb
Wind: 10 mph WNW
Wind Gust: 0 mph
UV Index: 0
Precipitation: 0 mm
Clouds: 40%
Rain Chance: 0%
Visibility: 10 km
Sunrise: 4:51 am
Sunset: 9:18 pm
DailyHourly
Daily ForecastHourly Forecast
Tomorrow 10:00 pm
weather icon
16° | 18°°C 0.99 mm 99% 13 mph 86 % 1015 mb 0 mm/h
Tue Jul 08 10:00 pm
weather icon
13° | 24°°C 0.2 mm 20% 11 mph 76 % 1020 mb 0 mm/h
Wed Jul 09 10:00 pm
weather icon
15° | 26°°C 0 mm 0% 6 mph 66 % 1023 mb 0 mm/h
Thu Jul 10 10:00 pm
weather icon
19° | 31°°C 0 mm 0% 8 mph 63 % 1024 mb 0 mm/h
Fri Jul 11 10:00 pm
weather icon
20° | 30°°C 0 mm 0% 12 mph 54 % 1023 mb 0 mm/h
Tomorrow 1:00 am
weather icon
17° | 17°°C 0 mm 0% 9 mph 72 % 1007 mb 0 mm/h
Tomorrow 4:00 am
weather icon
16° | 17°°C 0.31 mm 31% 8 mph 76 % 1007 mb 0 mm/h
Tomorrow 7:00 am
weather icon
14° | 15°°C 0.99 mm 99% 10 mph 86 % 1008 mb 0 mm/h
Tomorrow 10:00 am
weather icon
17° | 17°°C 0.33 mm 33% 12 mph 53 % 1011 mb 0 mm/h
Tomorrow 1:00 pm
weather icon
22° | 22°°C 0 mm 0% 13 mph 37 % 1012 mb 0 mm/h
Tomorrow 4:00 pm
weather icon
20° | 20°°C 0 mm 0% 10 mph 41 % 1013 mb 0 mm/h
Tomorrow 7:00 pm
weather icon
20° | 20°°C 0 mm 0% 7 mph 45 % 1014 mb 0 mm/h
Tomorrow 10:00 pm
weather icon
17° | 17°°C 0 mm 0% 11 mph 49 % 1015 mb 0 mm/h
Name Price24H (%)
Bitcoin(BTC)
€92,846.61
1.13%
Ethereum(ETH)
€2,201.66
3.04%
Tether(USDT)
€0.85
-0.01%
XRP(XRP)
€1.94
2.80%
Solana(SOL)
€129.90
3.77%
USDC(USDC)
€0.85
0.00%
Dogecoin(DOGE)
€0.146693
5.21%
Shiba Inu(SHIB)
€0.000010
3.59%
Pepe(PEPE)
€0.000008
5.71%
Scroll to Top