US EditionLastPass Data Breach — Insufficient Security Exposed 1.6 Million Users
The UK Information Commissioner's Office fined LastPass £1.2 million after breaches exposed personal data of 1.6 million UK users due to weak security policies and delayed breach detection.
- The U.K. Information Commissioner's Office has fined LastPass £1.2 million for a 2022 breach affecting up to 1.6 million UK users after it failed to implement sufficiently robust security measures.
- In August 2022, two interconnected breaches began that led to the incident, starting with a company software developer's work-issued MacBook Pro exposing 14 out of around 200 source code repositories.
- Attackers exploited a Plex vulnerability on a senior DevOps engineer's personal PC, installed a keylogger, and stole AWS and decryption keys, as Karim Toubba explained, `The threat actor copied information from backup that contained basic customer account information and related metadata including company names, end-user names, billing addresses, email addresses, telephone numbers, and the IP addresses from which customers were accessing the LastPass service`.
- John Edwards, the U.K. Information Commissioner, said LastPass fell short in protecting personal data, prompting the fine, while a LastPass spokesperson said it is cooperating and improving security.
- With a consumer base of over 20 million and 100,000 businesses relying on it, researchers linking six-figure cryptocurrency heists to the breach prompt UK businesses and organisations urged to review device security, remote work risks and access restrictions.
11 Articles
11 Articles
UK fines LastPass over 2022 data breach impacting 1.6 million users
The UK Information Commissioner's Office (ICO) fined the LastPass password management firm £1.2 million for failing to implement security measures that allowed an attacker to steal personal information and encrypted password vaults belonging to up to 1.6 million UK users in a 2022 breach.
Password security firm hit for password security failings - DecisionMarketing
A company which pledged to help people improve their online security has been battered by the Information Commissioner’s Office after enabling a hacker to steal personal information relating to 1.6 million UK customers. The regulator found that password manager provider LastPass UK failed to implement sufficiently robust technical and security measures, which ultimately enabled a hacker to gain unauthorised access to its backup database. There i…
Coverage Details
Bias Distribution
- 100% of the sources are Center
Factuality
To view factuality data please Upgrade to Premium
