LastPass users are going to get whiplash. The company said on Dec. 28 that some of its users were affected by credential stuffing attacks—attempts to sign in to someone’s account with usernames and passwords leaked from other services—but now it says that isn’t the case.
But LastPass says it has “no indication that any LastPass accounts were compromised by an unauthorized third-party as a result of these credential stuffing attempts” or “that user’s LastPass credentials were harvested by malware, rogue browser extensions, or phishing campaigns.”
“Our investigation has since found that some of these security alerts, which were sent to a limited subset of LastPass users, were likely triggered in error,” the company says. “As a result, we have adjusted our security alert systems and this issue has since been resolved.”
Password managers are supposed to make it easier for people to use strong, unique passwords for all of their accounts, so there would have been a certain irony to attackers gaining access to LastPass accounts that relied on master passwords reused from other services.
LastPass says it minimizes the risk of users’ master passwords being leaked by using a “zero-knowledge security model” that means the company doesn’t “store, have knowledge of, or have access to a user’s Master Password(s).” It can’t expose something it doesn’t have.
Still, the company has advised its users to make sure their master passwords are unique, and to use multi-factor authentication for their accounts if possible. And of course the usual advice—being wary of phishing attacks, using antivirus software, etc.—was dispensed as well.
