--- title: "According to LastPass, hackers stole encrypted passwords and customer data." description: "LastPass stated in August that it has found no proof that hackers had accessed client information or encrypted password vaults." author: "Muskan Singh" published: 2022-12-23 canonical: https://www.mindstick.com/news/2618/according-to-lastpass-hackers-stole-encrypted-passwords-and-customer-data category: "data security" tags: ["database", "database security", "data protection", "hackers"] reading_time: 2 minutes --- # According to LastPass, hackers stole encrypted passwords and customer data. - According to LastPass, the initial breach occurred in August. - The master password that users create is not stored. - Mandiant, a cybersecurity company, has been engaged by LastPass to look into the hack. \ A password management service called LastPass revealed on Thursday that hackers had taken encrypted copies of user passwords as well as other [private information](https://yourviews.mindstick.com/view/84032/how-to-stop-google-from-collecting-your-private-information-from-google) like [IP addresses](https://www.mindstick.com/forum/157830/what-is-dhcp-and-what-are-some-of-the-benefits-of-using-dhcp-to-manage-ip-addresses-on-a-network), billing addresses, and phone numbers. **The disclosure represents the most recent information about a breach that happened in August.** The business claimed at the time that it had seen no proof that the hackers had accessed client data or encrypted password vaults. However, the business claimed in a statement on Thursday that [source code](https://www.mindstick.com/forum/33476/pls-send-me-source-code-for-changing-passward-in-asp-dot-net-i-tried-so-much-from-google-but-its-not-workining) and [**technical data**](https://www.mindstick.com/news/2600/telecom-and-data-protection-bills-are-likely-to-be-introduced-in-the-monsoon-session-of-parliament) that were taken in connection with that theft were used to target one additional employee. When data was encrypted and kept on a third-party cloud [storage space](https://answers.mindstick.com/qa/102726/how-to-check-laptop-storage-space), the hackers were able to access it by obtaining credentials and keys. They were able to steal 'fully-encrypted sensitive areas such as website usernames and passwords, secure notes and form-filled data,' as well as 'basic customer account information, including email addresses and the IP addresses from which consumers accessed LastPass. **According to LastPass's statement, neither the corporation nor its servers are aware of the master password.** The business stated that the only way to decipher the other encrypted [**data**](https://www.mindstick.com/news/2355/data-protection-legislation-will-stop-the-exploitation-of-client-data-and-punish-offenders) is 'with a unique encryption key created from each user's master password.' Yet LastPass cautioned users that they might be the target of [social engineering](https://www.mindstick.com/forum/158557/what-are-the-key-steps-involved-in-conducting-a-successful-social-engineering-attack), [phishing scams](https://answers.mindstick.com/qa/103645/how-to-avoid-phishing-scams), or other tactics. The threat actor 'may try to employ brute force to guess your master password and decrypt the copies of vault data they obtained,' according to a statement from the business. \ It would be very difficult to try to brute force guess master passwords for those clients that follow [our password](https://answers.mindstick.com/qa/93285/how-can-we-change-our-password) best practises because of the hashing and encryption procedures we utilise to defend our clients. According to LastPass, it would take [millions of years](https://yourviews.mindstick.com/story/4992/10-creatures-that-haven-t-changed-in-millions-of-years) for password-cracking software to successfully guess a user's master password if they follow the company's password recommendations. --- Original Source: https://www.mindstick.com/news/2618/according-to-lastpass-hackers-stole-encrypted-passwords-and-customer-data Copyright © MindStick Software Pvt. Ltd. This Markdown version is provided for developers, AI systems, and offline reading.