When you use a password manager that relies on zero knowledge, you must set up a master password. LastPass uses this security model to protect sensitive data in your vault. Zero knowledge architecture is a design approach that ensures nobody can access secure data except the end user. With the investigation into the scope of the breach ongoing, Toubba sought to allay fears: “Our customers’ passwords remain safely encrypted due to LastPass’s Zero Knowledge architecture.” What is Zero Knowledge Architecture in LastPass? An unauthorized party used information stolen during the August incident to access some aspects of customer information. In November 2022, the company detected suspicious activity in a third-party cloud storage service that LastPass shares with an affiliate, GoTo.

LastPass revealed details of the initial security incident on August 25, 2022, notifying customers that attackers had taken some of the company’s source code and technical information. When hackers compromise these software applications, the entire industry of identity and access management (IAM) takes notice.Īs an alliance of tech giants leads a global push toward passwordless technology, security breaches like this beg the question: What is the future of password managers? How Bad Was the LastPass Hack? Password managers have one vital job: keep your sensitive login credentials secret, so your accounts remain secure. Although company CEO Karim Toubba assured customers they had nothing to worry about, the incident didn’t inspire confidence in the world’s leading password manager application. In November 2022, LastPass had its second security breach in four months.

Last pass security breach