The LastPass breach: what to do now

Just before Christmas, LastPass confirmed attackers had copied backups of customer vaults. The passwords inside are encrypted with each user’s master password. Website addresses in the vaults were not encrypted.

So the attackers now have a lot of time to try guessing master passwords, offline, with no lockout. Whether that works depends on yours.

What I’d do:

• If your master password was short, reused or ever leaked: assume the vault can be opened. Change the important passwords stored in it, starting with email, banking, cloud and work accounts.
• If it was long and unique: you’re in much better shape. Still change the most critical ones over the next weeks.
• Check your iteration count in the account settings. Older accounts sometimes had a very low number, which makes guessing much faster. Raise it.
• Turn on MFA on the accounts behind those passwords, so a stolen password alone isn’t enough.
• Watch for phishing “from LastPass”. The leaked URLs tell attackers which sites you use.

Password managers are still the right answer. This is why the master password must be the best one you have.