LastPass users’ vault stolen

If you are a LastPass user, here is what you should do.

LastPass has a very serious cybersecurity incident. They have just made this announcement. The crucial part of this announcement is:

The threat actor was also able to copy a backup of customer vault data from the encrypted storage container which is stored in a proprietary binary format that contains both unencrypted data, such as website URLs, as well as fully-encrypted sensitive fields such as website usernames and passwords, secure notes, and form-filled data. These encrypted fields remain secured with 256-bit AES encryption and can only be decrypted with a unique encryption key derived from each user’s master password using our Zero Knowledge architecture. As a reminder, the master password is never known to LastPass and is not stored or maintained by LastPass. 

Simply put, their users’ password vaults that are stored on the cloud (on LastPass’s servers) are stolen!

If you are a LastPass user, there is one consoling fact: Since LastPass makes it their business NOT to know your master password, hackers cannot know it either. As long as hackers cannot guess your master password, they will not be able to decrypt your password vault.

If you are a LastPass user, what do you need to know and do?