The company states that user data remains secure and it continues to investigate the incident. Credit: Hernan4429 / Getty Images LastPass, maker of a popular password management application, revealed Thursday that an unauthorized party gained access to its development environment through a compromised developer account and stole some source code and proprietary technical information. An initial probe of the incident has revealed no evidence that customer data or encrypted password vaults were accessed by the intruder, CEO Karim Toubba stated in a company blog post.Toubba explained that the master passwords of the company’s users are protected by a zero-knowledge architecture, which prevents LastPass from knowing or accessing those passwords.“Our products and services are operating normally,” adds LastPass spokesperson Nikolett Bacso Albaum. “In response [to the incident], we immediately initiated an investigation, deployed containment and mitigation measures, and engaged a leading cybersecurity and forensics firm.” “While our investigation is ongoing,” she continues, “we have achieved a state of containment, implemented additional enhanced security measures, and see no further evidence of unauthorized activity.” Password managers an attractive targetWhile the motive of the people responsible for this LastPass incident is unknown, password managers are a challenging but attractive target for threat actors, observes Melissa Bischoping, an endpoint security research specialist with Tanium, an endpoint management and security company. “They unlock—quite literally—a treasure trove of access to hundreds of thousands of accounts and sensitive customer data in an instant, if they are breached,” she says.Also unknown is how the developer account was compromised. Presumably, LastPass had proper authentication controls in place, but sometimes “even strong authentication solutions are not enough for various reasons,” says Rajiv Pimplaskar, CEO of Dispersive Holdings, a secure access service edge provider. LastPass able to contain the damageTaylor Ellis, customer threat analyst at Horizon3.ai, an automated penetration testing as a service company, praises LastPass for the way it has handled the incident. “Whenever a breach occurs, many organizations fail to isolate the incident quickly, or they struggle with how to guide a proper security investigation,” she explains. “As an experienced security company, LastPass at least had the home team advantage by following the correct procedures, isolating the issue on time, and preventing their customers from being severely impacted by the breach.” Related content news CISA, FBI urge developers to patch path traversal bugs before shipping The advisory highlights how developers can follow best practices to fix these vulnerabilities during production. By Shweta Sharma May 03, 2024 3 mins Vulnerabilities news Microsoft continues to add, shuffle security execs in the wake of security incidents The company has appointed new product security chiefs as well as a customer-facing CISO as it continues to respond to high-profile attacks on its products and own network. By Elizabeth Montalbano May 03, 2024 4 mins CSO and CISO feature Malware explained: How to prevent, detect and recover from it What are the types of malware? How does malware spread? How do you know if you’re infected? We've got answers. By Josh Fruhlinger May 03, 2024 18 mins Ransomware Phishing Malware brandpost Sponsored by Cyber NewsWire LayerX Security Raises $26M for its Browser Security Platform, Enabling Employees to Work Securely from Any Browser, Anywhere Early adoption by Fortune 100 companies worldwide, LayerX already secures more users than any other browser security solution and enables unmatched security, performance and experience By Cyber NewsWire May 02, 2024 4 mins Cyberattacks Security PODCASTS VIDEOS RESOURCES EVENTS SUBSCRIBE TO OUR NEWSLETTER From our editors straight to your inbox Get started by entering your email address below. Please enter a valid email address Subscribe