LastPass revealed in December 2022 that a significant data breach occurred, which enabled cyber-attackers to gain access to encrypted password vaults. The breach was the result of the same perpetrator launching a second attack on LastPass systems. According to the company, the breach occurred due to one of its DevOps engineers having their personal computer compromised and infected with a keylogger. This happened as part of a persistent cyber-attack that extracted confidential data from LastPass's Amazon AWS cloud storage servers. The attackers utilised information that was stolen during the initial attack, as well as details obtained from a third-party data breach and a flaw in a third-party data breach and a flaw in a third-party media software package to execute a synchronized second attack.
Read more here.
