2 ms·
> The initial investigation found no evidence of threat actors accessing customer data or password vaults, meaning no action from end users was required. I thi
by ghostpepper 4y ago
> The initial investigation found no evidence of threat actors accessing customer data or password vaults, meaning no action from end users was required.
I think the key word here is "initial" - they have no evidence thus far that user data was compromised, but that doesn't mean it wasn't, or even that evidence doesn't exist - right?
I get wanting to make a statement promptly and reassure customers but I'm not sure how valuable this is for users of LastPass. Should they just assume everything is fine until the company discovers it's not?
- Genbox 4y ago> but that doesn't mean it wasn't, or even that evidence doesn't exist - right? That is how it works. You can't prove a negative, so the data is not compromised until the investigation shows that it is. The developer's credentials was compromised, but those credentials don't give access to the production databases where customer data is stored, then there is a good reason to assume no customer data was breached. Of course you still do due diligence and investigate anyway, just to be 110% sure.