The data breach LastPass suffered in August enabled a hacker to infiltrate the company again and steal customer information.
On Wednesday, LastPass announced it was investigating the breach, which involved a third-party cloud storage service connected to company systems.
“We have determined that an unauthorized party, using information obtained in the August 2022 incident, was able to gain access to certain elements of our customers’ information,” the company wrote in a blog post.
What data was stolen remains unclear. But LastPass has said customers' passwords should remain safe, since the company doesn’t store information on the “Master Password” customers use to access the encrypted password vaults over the platform.
“We are working diligently to understand the scope of the incident and identify what specific information has been accessed. In the meantime, we can confirm that LastPass products and services remain fully functional,” the company said.
Still, the incident shows the August breach at LastPass was more serious than initially thought. At the time, the company said the August breach only ensnared its internal systems for software development —not any data concerning customer passwords. Nevertheless, the hacker was able to steal portions of company source code and some proprietary LastPass technical information, which likely paved the way for the follow-up intrusion.
In September, LastPass also said it had concluded its investigation into the breach with the help of cybersecurity firm Mandiant. The results found the hacker only had access to the internal systems for four days. No evidence was found of any tampering either. But it seems LastPass still failed to uncover all the potential ways the hacker could use the access to breach the company again.
LastPass didn’t name the third-party cloud storage service the hacker used to breach the company for a second time. But LastPass has been sharing the cloud storage service with its affiliate GoTo. Both companies are currently owned by private equity firms.
In response to the new breach, LastPass has deployed additional security measures and monitoring of the company’s IT infrastructure. It's also contacted Mandiant and law enforcement about investigating the hack.