3 ms·
I understand that the security of customer data is the focus, but is it yet known how access was gained? I ask because I presume LastPass put a heavy emphasis
by jfoster 4y ago
I understand that the security of customer data is the focus, but is it yet known how access was gained?
I ask because I presume LastPass put a heavy emphasis on security, yet this still happened. Is there a 0-day still out there in the hands of very malicious actors and not yet patched?
- catalypso 4y agoIt seems that it was a social engineering attack. From their notice: https://blog.lastpass.com/2022/12/notice-of-recent-security-incident/ https://blog.lastpass.com/2022/12/notice-of-recent-security-... > some source code and technical information were stolen from our development environment and used to target another employee
- jfoster 4y agoThat's still very vague, though. How was the initial (src + docs) breach performed? How do they escalate that into a successful social engineering attack, particularly since the breach was known of? Did the targeted employee have unfettered access to all this customer data? Will be interesting to know the fuller story. I'm guessing that's only a matter of time.