Bad news - LastPass owner confirms customer backups were stolen

(Image credit: LastPass)

Another update on the recent LastPass data breach has revealed even more potentially bad news for users of the password manager.

Paddy Srinivasan, CEO of LastPass parent company GoTo revealed in a blog post that the attackers who targeted third-party cloud storage service shared by both firms managed to exfiltrate encrypted backups related to a number of products.

These products include Central, Pro,, Hamachi, and RemotelyAnywhere. 

TechRadar Pro needs you! We want to build a better website for our readers, and we need your help! You can do your bit by filling out our survey and telling us your opinions and views about the tech industry in 2023. It will only take a few minutes and all your answers will be anonymous and confidential. Thank you again for helping us make TechRadar Pro even better.

D. Athow, Managing Editor

Encryption key taken 

Besides encrypted backups, the attackers also exfiltrated an encryption key for “a portion” of the encrypted backups, Srinivasan added. 

The data that is now at risk includes account usernames, salted and hashed passwords, a portion of Multi-Factor Authentication (MFA) settings, and some product settings and licensing information. Credit card or banking details were not affected. Birth dates, home addresses, and Social Security numbers, were also said to be secure, as GoTo doesn’t store any of these. 

Furthermore, a “small subset” of Rescue and GoToMyPC users have had their MFA settings impacted. Encrypted databases, however, were said to not have been taken.

While all of the account passwords were salted and hashed “in accordance with best practices”, GoTo still reset the passwords of affected users, and had them reauthorize MFA settings, where possible. The CEO also said the company is migrating affected accounts onto an enhanced Identity Management Platform to provide additional security and more robust authentication and login-based security options.

The affected customers are being reached out to directly, Srinivasan confirmed. 

LastPass first reported suffering a data breach in November 2022. An initial investigation determined that the hackers managed to steal customer vaults, essentially databases containing all of their passwords. The vaults themselves are encrypted, however, meaning the crooks will not have such an easy time reading their contents. 

“These encrypted fields remain secured with 256-bit AES encryption and can only be decrypted with a unique encryption key derived from each user’s master password using our Zero Knowledge architecture,” LastPass CEO Karim Toubba had said. “As a reminder, the master password is never known to LastPass and is not stored or maintained by LastPass.”

Sead Fadilpašić

Sead is a seasoned freelance journalist based in Sarajevo, Bosnia and Herzegovina. He writes about IT (cloud, IoT, 5G, VPN) and cybersecurity (ransomware, data breaches, laws and regulations). In his career, spanning more than a decade, he’s written for numerous media outlets, including Al Jazeera Balkans. He’s also held several modules on content writing for Represent Communications.