Just when you thought theLastPass breach of 2022was over, we’re still learning just how detrimental the hack was. According to blockchain expert ZachXBT and spotted byThe Block, $5.36 million was stolen from 40 users in a string of attacks. This is on top of the $4.4 million stolen in October 2023 and $6.2 million earlier this year in February 2024.
The original hack goes back to 2022 when hackers claimed to have accessed LastPass’ data, which contained API tokens, customer keys, multifactor authentication seeds (MFA), and encrypted password vaults. Although no official information explains how the breach happened, it’s possible that the hacker responsible gained access to information that aided the breach. Hackers forced their way in despite the password vaults being encrypted because users reused weak or previously leaked combinations. This access, combined with the users’ weak or reused passwords, led to the various accounts being compromised.
“Cannot stress this enough, if you believe you may have ever stored your seed phrase or keys in LastPass migrate your crypto assets immediately,” ZachXBT wrote in anX postlast year.
Only time will tell if this string of attacks continues, which makes you wonderif LastPass is safe. But how did theoriginal breach happen?LastPass revealed that the hackers stole the app’s source code. In a subsequent attack, the hackers merged the stolen data with information discovered in another data breach.
The hackers then exploited a weakness in a remote-access app that LastPass employees used. This allowed the hacker to install a keylogger onto the PC of a senior engineer at LastPass, which registered all the key inputs.
The breach highlights the importance of alwayshaving a strong passwordon all your accounts. Never reuse passwords or have easy-to-guesspasswords that hackers will love you for. If creating long, strong passwords is not your thing, you can always use one of thebest password generators.
