Password Manager Last Pass Warns of Breach
Summary: LastPass disclosed on Monday that intruders broke into its databases and took user email addresses, password reminders, server per-user salts, and authentication hashes, though the company said it found no evidence encrypted vault data was taken or accounts were accessed. LastPass said it strengthens authentication hashes with a random salt and 100,000 rounds of server-side PBKDF2-SHA256 on top of client-side rounds, and Columbia computer science professor Steve Bellovin said the stolen password reminders are more concerning because they are useful for targeted attacks.
What you should know: The stolen password reminders paired with email addresses give an attacker the raw material for targeted phishing against specific LastPass users, and Bellovin notes that a hint which seems harmless to a stranger can still be enough for someone who knows the target.
Read the original at Krebs on Security ↗
- Topics
- Identity & Access Management
- Related
- FBI flash alert says Artex tool automating cyberattacks at ‘machine speed’ Cyber Risks · Nov 13, 2026Connect Wise Cloud Backup application abused in cross-tenant token sweep Cyber Risks · Oct 19, 2026Sponsored: Specter Ops on the impact of AI agents on Blood Hound Cyber Risks · Sep 20, 2026