13 ms·
LastPass notifies users of yet another data breach
- lyu07282 4mo agohttps://news.ycombinator.com/item?id=48657784 https://news.ycombinator.com/item?id=48657784 https://news.ycombinator.com/item?id=48647272 https://news.ycombinator.com/item?id=48647272 Third time's the charm
- TZubiri 4mo ago>“On June 12th, LastPass was made aware of an incident that occurred at Klue (klue.com), a third-party market intelligence platform utilized by our go-to-market teams, which integrates with our Salesforce and Gong systems,” The specific dependency that gets companies infected, and the optics that result, are so important. There have been sillier examples, but you can see how in this case, the priority of sales and profits has resulted in the sacrifice of the main quality measure of their main and only product.
- fn-mote 4mo ago> the priority of sales and profits has resulted in the sacrifice of the main quality measure of their […] product To be fair, and I don’t want to, supposedly the only thing that was compromised was contact info. No vaults were exfiltrated or unlocked (as far as the article info goes). So this is really just another very boring info breach, not a targeted password-stealing hack. The other breaches they suffered were worse.
- psandor 4mo ago“ the priority of sales and profits has resulted in the sacrifice of the main quality measure of their main and only product” What do you mean exactly here What do you think LastPass could have done to prevent this specific issue?
- khurs 4mo agoDid they need to give them all of this? customer names, phone numbers, email addresses, physical addresses, support case data, sales-related data.
- secabeen 4mo agoGenerally yes, if you want to use a Customer Relationship Management system like Salesforce. Customer names, contact information, and info about what they bought from you is table stakes data for CRM is it not?
- TZubiri 4mo agoIf you are selling B2B or high ticket items, sure. But these are customers of a security product. It's as silly as running the names of mcdonalds customers through an AI to find hidden sales insights
- lyu07282 4mo agoBitwarden doesn't redirect you to a third party if you visit their support page: https://bitwarden.com/help/ https://bitwarden.com/help/ But LastPass does (Salesforce CNAME): https://support.lastpass.com/s/?language=en_US https://support.lastpass.com/s/?language=en_US So this couldn't have happened to bitwarden, you own the reputation loss if any of your suppliers get owned. Though it really doesn't matter anymore for LastPass they leaked their customers vaults before, I have no idea how they can still be in business.
- pasc1878 4mo agoNot supply the information to any other company.
- TZubiri 4mo agoNot installing the infected package of course. It's worth noting that this is not 'their marketing provider' what they do is load 30 different providers for some reason, to maximize the reach of their data sharing and advertising network. Well, their network reached too far and touched an infected node.
- TZubiri 4mo agoUsing a password manager has 2 main tradeoffs and mistakes: 1- Tradeoff individual account risk, for systemic risk. You may argue password managers are safe, but few would argue that the risk model reduces the risk of individual password leaks more than the risk of all your passwords leaking. It's a tradeoff. 2- Cat and mouse security: There's a class of security decisions that work because they are new and different. First the weakness was that passwords were short, then you make passwords long but unmemorable, so people rely on some other mechanisms to authenticate, like a file on their computer, a drive, a fingerprint, facial recog, which may in turn be protected by a second factor password. At first the new security model will not be stressed, but as more users migrate from one security model to the next one, that's when you are able to compare the security of both technologies, it starts being a juicy enough target that it becomes attacked. So we are at the point where password managers are used enough that they start becoming worthwhile targets of attack (to overcome the difficulty of vulnerating them). Also worth noting that these attacks are more winner-takes-all. In the sense that rather than seeing one account hacked every couple of hours, you will see them all hacked at once, because you introduced a vendor in the password supply chain AND because the vendor centralizes all of the passwords. So target that one vendor and from a single attack you get all the spoils. So when comparing the security of the olden method and the new, just 1 incident is enough to undo all of the reputational gains it has made over the years.
- zarzavat 4mo ago"Password manager" used to mean a program that runs locally on your computer. At some point people started making it into a SaaS, because that's more profitable. I do think there are some cases where an online password manager makes sense, e.g. for businesses, but for individuals it's better to just stick with an offline password manager, at least for the high value accounts.
- pdimitar 4mo agoYou can and should have the best of both worlds. Using Enpass, the program _is_ local, it just backs up the entire database (encrypted SQLite3) to a cloud. But if even that is too much then f.ex. `keepass` + a scheduled script to periodically backup to your own servers is also perfectly viable.
- throwawayffffas 4mo agoSo... you business plan is to secure peoples personal data by handing some of that data to a third party. Got it.
- cyanydeez 4mo agothe Achilles heel of a "secrets vault" is it becomes a defacto priority target. I still dont see how any reasonable person was convinced a cloud service was the best place to put all their secrets.
- tlb 4mo agoGmail is at least as large a target, and they don’t keep having breaches.
- throwawayffffas 4mo agoThe problem is not the secrets vault. It's the casual acceptance of giving peoples data to third party processors. What value do last pass customers get from having their details passed on to a marketing firm? None. For all the talk of privacy and putting customers first they are acting like any other company in any other field.
- jagged-chisel 4mo agoHow does anyone seriously trust LastPass anymore? Years ago, I was working for a company handling bank data. They were using LP immediately following a previous LP security incident and had no plans to migrate away.
- pluc 4mo agoPeople still use Windows
- zulban 4mo agoA lot of people and orgs don't use security products for security. They use them for security theater. A vast majority of people, even many security people, will never hear about this breach. So LastPass still works great for them.
- stymaar 4mo agoAnd it will continue until we can sue company being breached for criminal negligence. Should a single company executive be personally liable in these situations, the scale of the problem would be orders of magnitude less severe because they would spend the appropriate amount of effort to cover their damn ass.
- jordanb 4mo agoThis is it. These companies don't really care about their customer's data. Their SDLC is no more rigorous than any other SaaS product. They have junior people and (now) AI pushing code with a quick "LGTM" PR check just like everyone else. The way to stop this is to have actual consequences for the decision makers here. You can build high-integrity software and some fields (avionics) have done it. But the organization needs to be built from the ground up to do it and nobody's going to do it if you can just get breached and offer a phony apology over and over again.
- Forgeties79 4mo ago“Here’s a year of credit monitoring. Be grateful.”
- fusslo 4mo agoI'm sure this is worse than using lastpass in some way but for the past couple years I've just generated and forgotten 90% of my passwords. the final 10% I keep in a password manager. But if the service isn't really that important I just use the 'forgot my password' to change and generate a new password every time I need to login
- stanac 4mo agoThis works if the account doesn't have 2FA. On my last side project app users can login only via email OTP. There are security downsides with that, someone can send phishing link and use OTP submitted to the fake site, but the app doesn't store anything sensitive (it's a game which tracks your progress) so I guess it's not a major security risk.
- seb1204 4mo agoI got caught out as I had no longer access to the old phone number that was now used to send 2FA text.
- fusslo 4mo agooh dang that's not good. I've had the same phone number since 2006 so I didn't really think about it
- antiframe 4mo agoBut the phone number you have is not 100% in your control. I had AT&T flub something and I lost my number and they assigned me a new one (I was chanting my plan just after they did some merging with someone). Granted its unlikely but I would still use defense in depth and not have password reset be my only login method.
- fusslo 4mo agoThats totally fair and really scary since so many services think 2fa means texting or calling a phone number (my bank for example)
- variety8675 4mo agohttps://blog.lastpass.com/posts/klue-supply-chain-incident-and-lastpass-response https://blog.lastpass.com/posts/klue-supply-chain-incident-a... > The information accessed was limited to standard business contact information and related customer relationship management (CRM) data, including customer names, phone numbers, email addresses, and physical addresses, as well as support case data and sales-related data.
- khurs 4mo ago>an incident that occurred at Klue (klue.com), a third-party market intelligence platform Well, I hope Klue got them more customers than they are losing due to this.
- asdf88990 4mo agoThey still have no klue.
- khurs 4mo agoLots more companies affected. Some more listed below: >"Klue has not said how many of its hundreds of customers are affected. Several companies have come forward to confirm they had data stolen during the attack, including Gong, Jamf, HackerOne, Insurity, OneTrust, Recorded Future, Snyk, Sprout Social, and Tanium." >Cybercrime group Icarus took credit for the breach, saying on its leak site that it will publish the stolen data on Monday if the company does not pay the hackers’ ransom." https://techcrunch.com/2026/06/22/klue-hack-results-in-data-breach-at-several-cybersecurity-firms/ https://techcrunch.com/2026/06/22/klue-hack-results-in-data-...
- deleted 4mo ago[deleted]
- fatata123 4mo ago[dead]
- chinathrow 4mo agoSitting here with my KeepassX and being happy, again.
- shizcakes 4mo agoFor folks new to the KeePass ecosystem, it’s KeePassXC[0] now. The original KeePass is still developed as well, however KeePassXC is a cross-platform updated version. [0] https://keepassxc.org/ https://keepassxc.org/
- panick21_ 4mo agoHow good is their mobile and sync story?
- cryo32 4mo agoI use keepassxc. I don’t sync mobile. My mobile device has an only the minimum subset of passwords I need saved on it.
- doubled112 4mo agoSyncing isn't a KeePassXC problem. The database is just a file. That may or may not make your life easier. There are a few decent Android and iOS apps that work well. I use Nextcloud and WebDAV for access. Not a setup I can recommend to just anybody though.
- shizcakes 4mo agoOne of the security advantages of KeePass being just a file is that you can sync it in the way that makes sense to you. The need to have an opinion on how you’d like to sync a file does, as you suggest, eliminate some portion of the population who need a fully baked answer in one step. I used to use Google Drive, but now I use Syncthing, further reducing my exposure. Paired with Synctrain and KeePassium on iOS. One tip: enable the atomic save option in settings to reduce the risk of weird cloud sync issues.
- insanitybit 4mo agoThis isn't great but it's not that big of a deal either. A lot of companies got bit by the Klue breach but it's not like your vaults are being accessed.
- mrhottakes 4mo agoThe vaults were accessed years ago
- insanitybit 4mo agoYes, in a separate breach.
- SV_BubbleTime 4mo ago>The vaults were accessed years ago > Yes, in a separate breech. Not nearly that cut and dry. Many, not all encrypted vaults leaked out. If you lost data it was because you used a weak master password for that vault.
- insanitybit 4mo agoMy point is the same - nothing about this breach implies vault access, it explicitly is related to the Klue breach, which contains some customer PII. > If you lost data it was because you used a weak master password for that vault. Even this is more complex (horrible pbkdf2 defaults, you're welcome for getting lastpass to increase them btw that was me) but it isn't relevant, no vaults are accessed in this breach.
- master-lincoln 4mo agoThe encrypted vaults, yes. Ideally they are worthless when the master password is sufficiently complex
- jazzyjackson 4mo agoiirc back then the vault wasn't encrypted as one blob, the domain name's belonging to each vault were revealed
- username135 4mo agoI switched to keepass a decade ago (maybe) and never looked back
- ChrisArchitect 4mo agoSource: https://blog.lastpass.com/posts/klue-supply-chain-incident-and-lastpass-response https://blog.lastpass.com/posts/klue-supply-chain-incident-a...
- john_strinlai 4mo agoany company that stuck around (or began using) lastpass after vaults were leaked probably does not care about this one at all, considering its just CRM data. i can sympathize a little bit with companies that stick with lastpass. when i had to switch an org from lastpass to 1password, it was a massive undertaking and incredibly annoying. however, i have no sympathy for anyone who has chosen lastpass after 2022.
- SV_BubbleTime 4mo agoAgreed. The non-story here is the data is of minor criticality. The real story is is that however minor, you expect LastPass to be better. They’re a password storage company, in order to be trusted they need to be better than this.
- paulbjensen 4mo agoOnce more onto the breach…
- jrm4 4mo agoLol. Again. Private company third party password managers are bad. Across the board. They're a bad idea. Deeply localized actual best practices can help solve this. Private companies can also help, but only if it isn't in the form of "you can't have this unless you pay for it." The point is, it's like fighting fires, you can't isolate it. It's a complete dead-end and the sooner the industry realizes this the better.
- felooboolooomba 4mo agoAny detailed info on why Klue had this data, apart from being their partner? How does it serve LastPass customers to give that data to Klue?
- saghm 4mo agoAlternate revenue source to keep them in business as they probably hemorrhage customers due to being maybe the least secure password manager ever? I have to wonder how they have any customers left at all at this point
- gomox 4mo agoNo, Klue is a competitive intelligence tool for sellers. You use it to keep track of "battle cards" (i.e. if they are selling a deal vs. 1Password, sales rep would go into Klue to see what the advantages of LastPass are vs that specific competitor). It's a purpose specific knowledge base, not a data broker or any sort. But it will surely have information of who you sold to or tried to sell to because of it.
- insanitybit 4mo agoManaging enterprise sales/ leads.
- greenavocado 4mo agoThis is why I use Microsoft Teams and Outlook as my password manager. I just save my passwords to draft or email them to my coworkers so they never lose track /s
- Peanuts99 4mo agoHello coworker of mine.
- thenews 4mo agooh well, time to remind users of keepass
- giancarlostoro 4mo agoI ditched LastPass long ago for BitWarden, though I mostly use the Passwords app from Apple now.
- angelmm 4mo agoQuite happy I moved away from LastPass long time ago. There are many options out there you can use.
- 1a527dd5 4mo agoI'm so glad we migrated away from LastPass (to BitWarden). It was a breach that caused us to move in the first instance.
- 0xAstro 4mo agoHow is the experience with BitWarden clients so far? Their chrome extension bugs out for me for the most basic tasks.
- CWuestefeld 4mo agoI was just making the change from LP to BW yesterday, completely by coincidence. My first reaction is that the out-of-box experience is poor. The first step was easy. The account creation and import of legacy data all went pretty well. But after that it wasn't so pretty. The first hurdle was trying to understand their model for sharing data (so my wife and I can share important credentials). The model that LastPass uses is pretty intuitive to me: it's just a matter of sharing a folder, so relatively transparent. But Bitwarden has a whole separate concept of "organization", and the items being managed don't go in "folders" here, but in "collections". So there are two separate, and subtly different, models in play, and this is confusing. The good news is that the client aggregates the data so when you're using it day-to-day to fill login forms, you don't have to worry about the differences. Once I'd gotten the data in place, I had to get the clients set up on the various platforms (browser extensions; desktop native, which is actually required for the browser extension's security to work right; phone). The OoB settings were entirely paranoid, and had me re-entering the complex master password over and over, really annoying me. Figuring out how to get to a reasonable balance required figuring out some settings whose labels are misleading. For example, "Unlock with PIN" sounded to me like it was going to add an extra layer of security, but it turns out that it really means "allow unlock using PIN in lieu of master password". Also, note that while most of the settings default to paranoia-level (like the "require master password every time I inhale", that I mentioned above), you will probably want to change the default crypto cypher. It defaults to PBKDF2, but a better modern approach is the other choice, Argon2id. ...which also reminds me that there's a distinct lack of parity between client platforms. Although you need the desktop native app to manage browser extension security, there's a bunch it can't do. For example, after importing my legacy data, I needed to select all the contents of my LP shared folders and move them to the BW organization collection, but the native app (which seems to be an Electron app, btw) doesn't have a multi-select feature; you need to do that in the online web app.
- woadwarrior01 4mo agoI think it's time for LastPass to rebrand themselves as First0wned.
- hbn 4mo agoI've been an Enpass user for years because I got a lifetime purchase for a good deal. They don't host the cloud services for syncing passwords. Instead you just auth your cloud storage (I use Google Drive) and it syncs to that. This approach seems better to me. For one thing, I'd already be screwed if someone malicious got into my Google account, probably worse than if they got into my password manager. And additionally, this means they're not creating an absolute jackpot of data to breach in a centralized place. No one's gonna hack Enpass of all their passwords because that would require hacking all of Google Drive, Dropbox, iCloud, etc. and looking for the files manually.
- overflowy 4mo agoHow is that different from KeyPass for example?
- andrewla 4mo agoAs another happy Enpass user I don't think it is significantly different. The exception being that the KeePass frontends are really just as expensive as Enpass is now. I also got a good deal on the lifetime pro membership before they moved to more of an annual model, which factors into my decision. Which Keepass frontend do you use (if you use one on mobile)? Keepassium and Strongbox seem to be the ones that people talk about, but they are pricey too. I don't know anything about AuthPass, but I'm reluctant to use a free product; I'd rather use an inexpensive one, just to hopefully thwart supply chain attacks on that front.
- echoangle 4mo ago> No one's gonna hack Enpass of all their passwords because that would require hacking all of Google Drive, Dropbox, iCloud, etc. and looking for the files manually. Or they compromise their self-update system if that exists.
- unstatusthequo 4mo agoLastPass is still behind TMobile on breach frequency, but maybe they will catch up soon.
- fred_is_fred 4mo agoThis looks like a customer data leak and not a vault leak? Still an issue but not a reason to go rotate every password - or am I misreading?
- eladbs 4mo agoNote #1428 to self: Delete all data from LastPass already.
- rawoke083600 4mo agoUnpopular take: I "just" use google chrome password manager for "everything".. yes im sure it horrifies some HN ppl but my thinking is, from all the password managers out there, does anyone one spend more on security or hire better security ppl or have access to better security tools and infra than google (yes yes im sure outliers and some counter examples exists). I routinely die a little inside when i see my gf (none techie) try and remember which one of her fav 3-5 often used passwords she has used for site/service abc as she tries to login. Kinda tongue in cheek, I always tell her if you can remember your password it's a bad one !
- bradley13 4mo agoWTF is LastPasd doing, handing customer details to a market research company? Any such data should have been fully anonymized: no names, no specific addresses, etc.. For anyone looking for a recommendation: I use KeepassXC with Keepass2Android. Open source, with a local database that you can choose to sync (or not). I sync using Own cloud.
- throwawayffffas 4mo ago> Any such data should have been fully anonymized: no names, no specific addresses, etc.. Why even give them that?
- ryandrake 4mo agoI've been using pwsafe for years. Also free and open source. Local-only vault. No cloud service to depend on that's going to incompetently lose your data. You can optionally store your vault in dropbox or iCloud drive, but why would you?
- pkulak 4mo agoI self host everything but email and credentials. Email because I already have a full time job, and credentials because if an emergency is sufficient enough to remove me from my hardware, that’s when I’ll need my passwords the most. To be fair, I could just sync the db somewhere safe.
- feelamee 4mo agopasswordstore.org also a nice alternative
- Froztnova 4mo agoThis is what I've been using for a long time now. It's probably too technical for most people, especially if you're talking about syncing across multiple devices, but that's not a problem for me.
- argee 4mo agoI, like many others, wanted to move off of LP but was too lazy. So I just exported my passwords and put them into Google Sheets. While I have rotated many of those passwords (especially the important ones) and put them into a better password manager, there are several I haven't — and they've remained safer in Google Sheets than in LP. The lesson here is to get off of LP ASAP, you can figure out where to go later.
- willmadden 4mo agoYou put your passwords in Google Sheets? The data there is not encrypted at rest. Google has 191k employees in countries like China, India, and Pakistan who could potentially access your records. Make sure you use something that encrypts your data at rest, preferably on a device you own and control.
- civet_java 4mo agoI had exactly this happen to me, suffered great monetary losses and had my identity stolen. I've learnt my lesson and have moved on to 1password. At the end of it I couldn't help but reflect on my foolishness. I realised just how much better I would've felt if only it had been an American, Canadian, or European Googler who stole my data. It really is the worst when malicious entities are Chinese, Indian, or Pakistani. Just the worst!!! (/s)
- deleted 4mo ago[deleted]
- deleted 4mo ago[deleted]
- argee 4mo agoI put my passwords in Google Sheets temporarily. Then I moved them to 1Password, except the throwaway stuff. Google accounts aren’t immune to being compromised, so I agree that it’s not a good home for passwords (without even the need to invoke internal threats) — but it felt safer than LastPass. Which ought to be an embarrassment.
- willmadden 4mo agoI find it hard to believe that LastPass still has users.
- sleepybrett 4mo agoDid lastpass also pull the dumbass 'no local vaults' move that 1password made? One of the nice things about a 'bring your own vault syncing' is that breaches like this don't have to mean a goddamned thing to you.
- stmw 4mo agoNot for this data, but in the past, yes - there is persistent pressure to do that for any maker of password managers, be it independent, in-browser or in-OS. (Source: I was a cofounder of a company that made a password manager as part of our product).
- sleepybrett 4mo agoI mean it's a better forcing function to keep your customers constantly upgrading and tied to your platform. You can't just make good tools anymore, now you make mediocre tools that are sticky through dark patterns.
- vysakh0 4mo agoThis has become all too common with lastpass. I migrated out during their last incident. I wonder how does it keep happening and how do customers still continue.
- pipes 4mo agoI can see how any password manager can be safe. Especially from supply chain attacks. I use password safe on android, it writes an encrypted file locally. I'd really like to be able to flat seal the app to prevent network access. But I don't think android has such a feature.
- lightedman 4mo agoTheres enough information here for enterprising people to commit blackmail. The companies responsible for these lapses of security should be paying, starting first with investors, then the C-suite. That'll put a stop to this negligence VERY quickly.
- dwheeler 4mo agoI'm so glad I left LastPass a long time ago. There are better alternatives.
- bdangubic 4mo agowhoever (willingly) still uses LastPass…
- paranoidrobot 4mo agoAs much as the collective dumping on LastPass for yet another breach, and how they're totally irresponsible for handing customer data to some third party is amusing. I think if people took a moment to actually look at what happened, they might realise that the story everyone has in their heads is quite different from reality. Klue is one of those CRM services that so many sales teams are using. Yes, you have to hand them customer records (email of the customer contacts, finance teams, etc). That show Klue delivers it's "market intelligence" thing about that customer. If you go to your sales teams and see what random stuff they have hooked up to your systems, I bet you will find similar things. Whether or not this is a good idea (I firmly dislike it), this is how sales teams work these days. If you try to take it away you will be fighting the entire sales organisation. I am more surprised that these breaches don't happen more often. It doesn't impact LastPass's actual password databases. (No affiliation with any of the entities involved in this)
- Terretta 4mo ago> I am more surprised that these breaches don't happen more often. They do.
- red-iron-pine 4mo agothey do. how often you notify the public is a completely different discussion.
- heldergg 4mo agoJust use pass... https://www.passwordstore.org/ https://www.passwordstore.org/
- hkchad 4mo agoAnyone still using lastpass in 2026 deserves this, I'm sorry but this company has proven time and time again they should not be trusted. I migrated off them years ago after one of these breaches and haven't looked back since.
- whyagaindavid 4mo agoWhy not just use a browser based password manager? Just works. You need only one tool that gets updated. And Browser vendors are extremely vigilant about security. All platforms covered.
- vrighter 4mo agoWhy anyone would even consider using an online password manager is beyond me. Keepass works perfectly offline, and it's easy to sync. Just copy one file. I set up syncthing on my pc and phone and I basically just forget about it. For other places I have a particular subdomain (guid) where I serve the current copy of the file, gated by a password. The database itself is protected by both a password and a yubikey.
- Friedduck 4mo agoI ditched them after the last incident. So glad I don’t have to go through that again.
- MetroWind 4mo agoI'll never understand why someone would store their password on someone else's computer...
- pigeons 4mo agoTime to give up and move on.
- simmestd 4mo ago[flagged]