Additional details about the breach and the aftermath came to light in February 2023.īecause LastPass initially failed to inform its users of the breach and to adequately protect them, we removed the score and Editors' Choice designation from this review. In late 2022, the company announced that a data breach exposed users' encrypted vault data and other unencrypted personal data. How to Set Up Two-Factor AuthenticationĮditors' Note: Previously, LastPass had been a four-star Editors’ Choice product.How to Record the Screen on Your Windows PC or Mac.

How to Convert YouTube Videos to MP3 Files.

How to Save Money on Your Cell Phone Bill.

How to Free Up Space on Your iPhone or iPad.

How to Block Robotexts and Spam Messages.

Probably after reading this thread, LP added another section in the recommendation page, confirming that 'the TOTP seeds used to generate the six-digit TOTP codes in your LastPass Authenticator are backed up to your LastPass vault using zero knowledge' such that they are also protected with your master password. Whether other seeds stored in the LP Authenticator were encrypted or leaked needs further disclosure. It seems that LP confirmed 'MFA seeds assigned to the user when they first registered their multifactor authenticator of choice to authenticate to the LastPass vault' were leaked, and they only recommend 'regenerate your shared secrets in your LastPass account settings' rather than other sites as well. So if you are using LastPass Authenticator, reset every seed stored in it.Īs comments pointed out, it is vague whether the TOTP secrets for other sites stored in the LP Authenticator were breached. They stored the key somewhere and the hacker took it along with the data. For some reason, this part was not encrypted using their zero-knowledge method (!).

Not just the LastPass 2FA seed, but all the secrets in your Authenticator. I think the most important information from this was that they confirmed the 2FA seeds were leaked and decrypted.

Last pass security