Change your LastPass Master Password — security incident no longer just a rumor

So, we’ve got good news and bad news. Good news is that the hacking attempt against LastPass from this August didn’t result in any user data getting stolen. Yay! However, it did allow hackers to steal some knowhow, which enabled them to target a LastPass employee, through which they — well — stole user data. Boo!

Now, we’ve got to commend LastPass for remaining transparent as per its own promises and sharing the story via a blog post. While it’s easy to make a jab here, we’re also certain that the situation is difficult for them as well.

While the hackers didn’t get any live data — as in up-to-date info, which is being stored and used in real time by LastPass servers — they did get their hands on backups. Since most people aren’t in the habit of randomly changing their passwords, in most cases these backups probably, maybe contain relevant information.

Here’s a list of the types of info which is confirmed to have been retrieved:

• Company and user names
• Billing addresses
• Emails
• Mobile numbers
• IP addresses

Suffice to say, in some cases, the malicious third party may have their hands on a full package of user data. No good at all. But what about usernames and passwords — the main types of data, which the company handles?

Well, those have been stolen too; however, they remain encrypted. That means that thanks to LastPass’ Zero Knowledge architecture, the culprits won’t be able to figure any of them out, until they know your master password.

What should I do to keep my LastPass account safe?