A threat actor gained unauthorized access to the LastPass development environment and stole source code.
The password manager LastPass has published a blog post notifying users of a recent data breach . According to the CEO, Karim Toubba, the breach affected parts of the company’s development environment but did not touch any databases containing user data or passwords. Rather than stealing user information, it seems that the threat actor behind this breach instead stole portions of LastPass source code, as well as some proprietary technical information. We’ll have to see whether the thief comes forward to publish this stolen information, either for sale or as part of an extortion scheme.LastPass identifies a single compromised developer account as the source of the breach. However, the company doesn’t reveal how the threat actor gained unauthorized access to this account.
