“The threat actor was able to capture the employee’s master password as it was entered, after the employee authenticated with MFA, and gain access to the DevOps engineer’s LastPass corporate vault.” “This was accomplished by targeting DevOps engineer’s home computer and exploiting a vulnerable third-party media software package, which enabled remote code execution capability and allowed the threat actor to implant keylogger malware,” LastPass wrote in an account of the situation. Attackers gained these incredible levels of access by targeting a specific LastPass employee who had high levels of system privileges.

A second breach later in August allowed hackers to exfiltrate sensitive data from the company's cloud storage. To recap the latest news, LastPass revealed in December 2022 that the August breach was worse than the company originally thought, resulting in encrypted copies of some users' password vaults being stolen, in addition to unencrypted personal information. As detailed in our previous articles about the LastPass breach - What to do if you're a LastPass User, LastPass - It's worse than we thought, and LastPass says hackers stole customer backups, the LastPass breach has had a devastating effect on both the company and its customers.

Lastpass mfa setup