Last Pass: ‘Horse Gone Barn Bolted’ is Strong Password
Summary: LastPass is now forcing some users to update master passwords shorter than 12 characters, a minimum it officially set in 2018 but never applied to an undisclosed number of earlier customers. In November 2022 LastPass disclosed a breach in which hackers stole password vaults containing encrypted and plaintext data for more than 25 million users, and researcher Wladimir Palant says the new emails are a PR stunt because he logged in with his weak password and was not forced to change it.
Bottom line: One KrebsOnSecurity interviewee who signed up nearly a decade ago with an eight-character master password and stored a cryptocurrency seed phrase in his vault saw more than three million dollars siphoned from his account, and LastPass CEO Karim Toubba says the password-length change is not designed to address already stolen vaults that are offline.
Read the original at Krebs on Security ↗
- Topics
- Data Breaches
- Related
- TSMC employee data breach linked to cloud provider Cyber Risks · Nov 15, 2026Data Breach at La Poste Subsidiary Maileva Affects 22 Million People in France Cyber Risks · Nov 15, 2026City of Osaka warns of data breach impacting 1 million as Japan reels from dozens of cyber incidents Cyber Risks · Nov 13, 2026