LastPass source code stolen: what it means for you
LastPass says attackers took source code but no vaults. A good moment to check the one password that protects all the others.
Last week LastPass said an attacker got into its development environment through a developer’s account and took source code and some technical information. LastPass says there’s no evidence customer data or encrypted vaults were accessed, and that users don’t need to do anything.
That may well be true. Stolen source code is still worth watching: it helps attackers look for weaknesses, and a first break-in is sometimes followed by a second.
So, without panic, use it as a reason to check your own setup:
- Your master password: long, unique, never used anywhere else. If it isn’t, change it.
- MFA on the password manager, ideally an app or a security key.
- The accounts that matter most (email, bank, work) should also have MFA, so a leaked password alone isn’t enough.
- Watch for phishing that uses this news. “Reset your LastPass password here” emails will come.
A password manager protects everything else. It deserves the strongest password you have.