LastPass got taken down because they allowed a developer to work remote from their home on their own personal PC. That PC had an unpatched vulnerability within

LastPass got taken down because they allowed a developer to work remote from their home on their own personal PC. That PC had an unpatched vulnerability within the version of Plex that the user was running. Some hackers got into their machine on a basic hack, and then hung around long enough to poke around and find the Plex vulnerability. They were able to inject their own code into the vulnerable Plex, and then ran a basic keylogger in the background without their knowing. At that point, they watched the user type in their LastPass admin credentials, and at that point they had the keys to the kingdom because LastPass didn’t have better auth protection. Many layers of the onion failed here which added up to a Swiss cheese effect. The hacks were very elementary, and nothing compared to something like Stuxnet or the NSO hacks.