LastPass has hired Mandiant to investigate a security incident, and customer passwords "remain safely encrypted," according to LastPass CEO Karim Toubba.
LastPass, based in Boston, Massachusetts, spun out from GoTo (formerly LogMeIn) less than a year ago. More than 33 million people use the LastPass password management platform, and the installed base spans more than 100,000 business accounts, according to the company's Website. LastPass also has an MSP partner program.
LastPass first disclosed this particular security incident on August 25, 2022. Two status updates -- on September 15 and November 30, 2022 -- have since surfaced.
LastPass 2022 Security Incident
In the latest update, Toubba disclosed that LastPass:
- "Recently detected unusual activity within a third-party cloud storage service, which is currently shared by both LastPass and its affiliate, GoTo."
- "Immediately launched an investigation, engaged Mandiant, a leading security firm, and alerted law enforcement."
- "Determined that an unauthorized party, using information obtained in the August 2022 incident, was able to gain access to certain elements of our customers’ information."
- "Our customers’ passwords remain safely encrypted due to LastPass's Zero Knowledge architecture."
LastPass is still working to "understand the scope of the incident and identify what specific information has been accessed." In the meantime, the company's products and services remain "fully functional," Toubba said.
LastPass did not disclose the nature or length of Mandiant's incident investigation services for the company. Google acquired Mandiant for $5.4 billion in September 2022.
LassPass: Previous Security Incidents
LastPass has disclosed multiple security incidents and breaches since the company's founding in 2008. Previous incidents of note occurred in 2011, 2015, 2016, 2017, 2019 and 2021.
