{"id":2902,"date":"2023-01-23T12:32:41","date_gmt":"2023-01-23T20:32:41","guid":{"rendered":"https:\/\/blogschapman.wpenginepowered.com\/information-systems\/2023\/01\/23\/update-on-lastpass-security-incident\/"},"modified":"2026-03-26T17:52:39","modified_gmt":"2026-03-26T17:52:39","slug":"update-on-lastpass-security-incident","status":"publish","type":"post","link":"https:\/\/blogs.chapman.edu\/information-systems\/2023\/01\/23\/update-on-lastpass-security-incident\/","title":{"rendered":"Update on LastPass Security Incident"},"content":{"rendered":"

What is LastPass?<\/span><\/b><\/h3>\n

LastPass is a password management software. It installs as a browser plug-in, standalone or mobile software. The user sets a \u201c<\/span>Master Password<\/span><\/b>\u201d and can use it to access all the different website passwords that are stored in a \u201c<\/span>Vault<\/span><\/b>.\u201d This makes it easier to store and manage passwords in a central location. There are many password managers out there, LastPass is just one of them.<\/span><\/p>\n

LastPass architects their service so that they do not possess your unencrypted secrets nor the keys to decrypt them. Encryption and decryption happen in the local client software on your device – this is an important layer of protection that mitigates the risk if vault secrets are compromised.<\/span>\u00a0<\/span><\/p>\n

If you use LastPass, please read the following.<\/span><\/p>\n

Chapman University and LastPass<\/span><\/b><\/h3>\n

Chapman University Information Systems and Technology did not have a campus-wide implementation of LastPass as a tool.<\/strong><\/p>\n

Since the impact was deemed minimal, an immediate notification was not needed for the Chapman University community. This notification raises awareness for those using LastPass for their personal passwords.<\/span><\/p>\n

What happened?<\/span><\/b><\/h3>\n

In December <\/span>2022<\/span>,<\/span> LastPas<\/span>s announ<\/span>ced <\/span>a breach of <\/span>their servic<\/span>es. <\/span>Unknown <\/span>actors o<\/span>btai<\/span>ned backup v<\/span>ersions of u<\/span>ser <\/span>vaults (<\/span>an indiv<\/span>idua<\/span>lized data s<\/span>tore of webs<\/span>ites<\/span>, userna<\/span>mes, and<\/span> pas<\/span>swords), inc<\/span>luding <\/span>unen<\/span>crypted <\/span>and encr<\/span>ypte<\/span>d informatio<\/span>n.<\/span><\/span><\/p>\n

What was obtained in the breach?<\/span><\/b><\/h3>\n

Copies of user vaults <\/span>that include both<\/span> unen<\/span>crypted data<\/span>,<\/span> such<\/span> as w<\/span>ebsite URLs<\/span>,<\/span> and encryp<\/span>ted data<\/span>,<\/span> such as usern<\/span>am<\/span>es<\/span> an<\/span>d pas<\/span>swords, se<\/span>cure notes, or form-fi<\/span>l<\/span>l<\/span>ed data.<\/span><\/span><\/p>\n

What they did NOT get<\/span><\/b><\/h3>\n

The attackers did not get the encryption keys <\/span>used<\/span> to encrypt stored usernames and passwords<\/span>. <\/span>LastPa<\/span>ss does not <\/span>possess<\/span> these keys, <\/span>which<\/span> are uniqu<\/span>e to each user.<\/span><\/span><\/p>\n

What are the risks of this breach?<\/span><\/b><\/h3>\n

The unencrypted data gives attackers information about where you have accounts. This may allow them to target those accounts for phishing campaigns, etc.<\/span><\/p>\n

The encrypted data is not readily accessible to the attackers and is encrypted by 256-bit AES (Advanced Encryption Standard) encryption. Nevertheless, they do possess a copy of that encrypted data.<\/span><\/p>\n

While it is unlikely they can decrypt this data anytime soon, there is a risk. Some analysts believe it is only a matter of time before the attackers can crack a given vault and access the encrypted data.<\/span><\/p>\n

What should LastPass users do to protect themselves?<\/span><\/b><\/h3>\n

Change all passwords for accounts that are stored in LastPass. The only way to fully protect yourself from the risk of your secrets eventually becoming known is to change all passwords stored in LastPass, including your Master Password.<\/span><\/span><\/p>\n