Last Pass Forces Users to Pick Another Password
Summary: LastPass forced all of its approximately 1.25 million users to change their master passwords after spotting a "traffic anomaly" - unexplained data transfers - from one of its databases on Tuesday morning. LastPass said the transfer was large enough to have moved email addresses, the server salt and salted password hashes, but not large enough to have pulled many users' encrypted data blobs.
Why it matters: The exposure matters because the threat is brute-forcing a weak master password with dictionary words and then presenting it to LastPass to retrieve the encrypted data - and LastPass's own blog acknowledged not everyone picks a master password immune to that. Users changing their master password from an unrecognized internet address had to validate their email first, and commenters reported being locked out of accounts and unable to reach the email needed to validate.
Read the original at Krebs on Security ↗
- Topics
- Data Breaches
- Related
- TSMC employee data breach linked to cloud provider Cyber Risks · Nov 15, 2026Data Breach at La Poste Subsidiary Maileva Affects 22 Million People in France Cyber Risks · Nov 15, 2026City of Osaka warns of data breach impacting 1 million as Japan reels from dozens of cyber incidents Cyber Risks · Nov 13, 2026