4 ms·
I asked about the totp seeds in a previous thread a few months back since those were not being mentioned (though I fully expected them to have been a part of th
by mcoliver 4y ago
I asked about the totp seeds in a previous thread a few months back since those were not being mentioned (though I fully expected them to have been a part of the backups that were accessed).
Looks like they were a part of it but even worse the attacker also got the decryption key (yikes!)
"Backup of LastPass MFA/Federation Database – contained copies of LastPass Authenticator seeds, telephone numbers used for the MFA backup option (if enabled), as well as a split knowledge component (the K2 “key”) used for LastPass federation (if enabled). This database was encrypted, but the separately-stored decryption key was included in the secrets stolen by the threat actor during the second incident."