A LastPass user has filed a class-action lawsuit against the password management provider for failing to prevent a recent, staggering data breach.
The lawsuit, filed this week in the US district court in Massachusetts, comes from an anonymous LastPass user named John Doe, who originally signed up for the service in May 2016. He’s now demanding the company pay in damages after LastPass announced last month it had lost a copy of every users’ password vaults to a hacker.
“Plaintiff and the Class are anxious and alert as they are at a substantial risk of being bombarded with phishing emails and other scams, in addition to the fraud they have already suffered,” reads the lawsuit, which is suing LastPass for negligence, breach of contract, and deceptive acts.
LastPass, which has over 30 million users, did not immediately respond to a request for comment. But the company has been trying to downplay the severity of the breach by saying the hacker only looted the encrypted password vaults for users. Hence, the hacker still needs the master password—which only the user knows—to access the individual password vaults.
However, the class-action lawsuit points out the hacker stole unencrypted personal information about users, including billing addresses, email addresses, telephone numbers, along with the website URLs assigned to each encrypted password. The hacker could easily exploit this information to target LastPass users with phishing emails designed to scam them.
The lawsuit also takes issue with LastPass’s claim that users ensnared in the breach remain protected because the company has no knowledge of their master passwords. “Not only has this statement not been verified through discovery, but it is also a shameless attempt by LastPass to shift the blame of the Data Breach’s resulting negative impact on Plaintiff and Class members,” the lawsuit argues.
The plaintiff behind the legal action is concerned a hacker could eventually guess the master passwords to individual vaults, citing advancements in password-cracking algorithms powered by today’s GPUs. In addition, the user suspects the breach at LastPass may have led a hacker to steal $53,000 in bitcoin from him over Thanksgiving weekend, since the private keys to his cryptocurrency transactions were stored on LastPass.
It was only on Dec. 22 when LastPass fully disclosed the disturbing scale of the breach, which was sourced back to a hacker who initially infiltrated the company in August.
“If Defendant had disclosed the full extent of the Data Breach in August instead of waiting months to do so, Plaintiff and Class members would have been on heightened alert and changed their passwords, thus avoiding the thefts that ensued,” the lawsuit adds. (That said, the lawsuit offers no evidence to show his bitcoin was lost due to hackers exploiting the breach at LastPass.)
In response, the class-action lawsuit is demanding the court force LastPass to apply better security practices, in addition to paying affected consumers damages.