While it is unlikely that they can decrypt this data anytime soon, there is a risk. Nevertheless, they do possess a copy of that encrypted data.

The encrypted data is not readily accessible to the attackers and is encrypted by 256-bit AES (Advanced Encryption Standard) encryption.

This may allow them to target those accounts for phishing campaigns, etc.

The unencrypted data gives attackers information about where you have accounts.LastPass does not possess these keys, and they are unique to each user. The attackers did not get the encryption keys that are used to encrypt stored usernames and passwords.Copies of user vaults that include both unencrypted data such as website URLs and encrypted data such as usernames and passwords, secure notes, or form-filled data.Key information and guidance for LastPass users: We still maintain that using a password manager is a valuable security measure that encourages the use of complex passwords, and plan to continue rolling out LastPass accounts to the university once a satisfactory assessment is completed. We recommend that current users follow the guidance provided below. While we get clarity on the extent and long-term effects of this breach and the corporate response to it, we are pausing this rollout.

Until LastPass can provide information on which vaults were obtained, we must assume that all vaults were obtained.Īs you may know, Virginia Tech was in the process of rolling out LastPass to portions of the university community. Unknown actors were able to obtain backup versions of user vaults (an individualized data store of websites, usernames, and passwords), which included both unencrypted and encrypted information.

In December 2022 LastPass announced a breach of their services. Headline: LastPass users encouraged to change passwords stored in LastPass to protect accounts

Last pass corporate