In the end, the company realized something was wrong when its AWS GuardDuty Alerts system warned it that someone was trying to use its Cloud Identity and Access Management roles to perform unauthorized activity. On a support page, LastPass said the way the second attack was carried out - by using genuine employee login details - made it difficult to detect. As well as that, it seems numerous products apart from LastPass were also breached. That included backups of LastPass’s multi-factor authentication database, API secrets, customer metadata, configuration data, and more. That said, plenty of important data was taken by the threat actors. When the hackers stole LastPass data, they were unable to get these decryption keys because they were not stored anywhere by LastPass.

That means they were encrypted with a key derived from each user’s master password and unknown to LastPass. Luckily for LastPass users, it seems that customers’ most sensitive data - such as (most) email addresses and passwords - were encrypted using a zero-knowledge method. A LastPass support page details exactly what was stolen. A large amount of sensitive customer data was also stolen, although it appears the hackers were not able to decrypt it. That’s important because LastPass kept production backups and critical database backups in the cloud.

Lastpass annual fee