The password management company LastPass experienced a data breach, and confirmed password vault data was obtained, but in encrypted form. Additionally, LastPass said names, email addresses, phone numbers and some billing addresses were stolen as well.
While encrypted password vaults can only be accessed with the user's master password, LastPass warns cybercriminals “may attempt to use brute force to guess your master password and decrypt the copies of vault data they took.”
What To Do If You're A LastPass User?
Ensure your master password is at least 12 characters long, and includes a mixture of capitalized and lowercase letters, numbers and symbols. However, if your master password does not meet or exceed those parameters, you should change it as soon as possible along with every password in your vault.
Additionally, make sure your master password is completely unique and not being used elsewhere. You should never reuse passwords under any circumstance.
When changing passwords in your vault, use a risk-based approach and start with your email and financial accounts and accounts that do not offer or do not have dual factor authentication enabled.
Enable dual factor authentication for LastPass. LastPass has its own LastPass Authenticator that can be used in conjunction with the LastPass Vault for users with Personal accounts.
As email addresses and phone numbers were stolen, be on the lookout for phishing emails, as well as phishing attacks that target your phone, including "smishing" and "vishing" scams.
Despite this incident, password managers are still the best method for storing passwords, and BlackCloak continues to recommend using them.
If you are a current LastPass user with a Personal account and would like to switch to a different password manager, such as 1Password, contact the BlackCloak Concierge team and we will help you find the right solution.
To learn more about creating strong passwords and securing them safely, listen to this webinar from BlackCloak Chief Experience Officer Ingrid Gliottone titled Password Management Best Practices.
