Résumé
LastPass is a password manager, the digital vault tens of millions of people trusted with every password they have. In 2022 attackers got into it, and the breach unfolded in a way that turned a developer's home computer into a path to those vaults. A first intrusion stole source code. The attackers used it to identify and target one of only four engineers who held the keys to production backups, planting a keylogger on his home PC through an unpatched flaw in, of all things, his Plex media server. With his master password captured, they exfiltrated backups of customers' encrypted password vaults. The encryption held, but anyone with a weak master password was now exposed to offline cracking at the attacker's leisure. It is the lesson that a vault is only as strong as the master password protecting it, and that your blast radius includes your engineers' home machines.
How it happened
There were two linked breaches. In August 2022, an attacker compromised a developer account and stole source code and technical documentation. Then they used that knowledge to go after a specific person: a senior DevOps engineer who was one of only four people with access to the production backup decryption keys. They exploited an unpatched vulnerability (CVE-2020-5741, a remote-code-execution flaw the engineer had left unpatched for years) in the Plex media software running on his home computer to install a keylogger, and captured his master password after he had already passed MFA, because a keylogger records the keystrokes regardless.
With those production keys, between 12 August and 26 October the attacker exfiltrated cloud backups: the encrypted customer vaults (but with the website URLs stored unencrypted, a metadata leak in itself), AWS S3 production backups, DevOps secrets, and even MFA seed databases. The vault contents were encrypted, but the crucial point is that once an attacker holds the stolen vault file, there is no rate limit on guessing, they can brute-force a weak master password offline, on their own hardware, for as long as they like. LastPass only caught the second intrusion when Amazon's GuardDuty flagged the attacker trying to use cloud access roles, by which point they had been inside for over two months.
The damage
The encrypted vaults of millions of customers were stolen, putting everyone with a weak or reused master password at risk of offline cracking, a risk they could not undo, because the data was already gone. The unencrypted URLs revealed which sites each person had accounts on, valuable targeting data. The slow-motion consequence was crypto theft: researchers at MetaMask and Unciphered traced roughly $35 million stolen across more than 150 victims who had kept seed phrases in their LastPass vaults, and in 2025 the US Secret Service tied a separate $150 million heist to the breach and clawed back about $24 million of it. The thefts were still being traced into late 2025, long after the headlines faded.
Why LastPass still matters
LastPass teaches two hard lessons. First, offline cracking: once an encrypted vault is stolen, your master password's strength is the only thing protecting it, so it must be long, unique, and protected by modern, high-iteration key derivation (LastPass's default was 100,100 PBKDF2 iterations, but many older accounts were found on far weaker settings, some as low as a single iteration). Second, the blast radius includes home machines and the handful of people with crown-jewel access: an unpatched media server on a personal PC was the foothold to production keys. The defences follow: use a long, unique master password or a passkey with the strongest key-derivation settings; separate work and personal devices and never let a personal machine reach production keys; tightly restrict and monitor the few with crown-jewel access; encrypt every field, not just passwords, because the plaintext URLs were themselves damaging; and rotate everything on exposure. It was part of the same broad wave of credential theft that fed attacks like Snowflake.
Comment le corriger
- For users: change your master password to a long, unique one, rotate the most sensitive stored passwords first (crypto, email, banking), and enable hardware-key or passkey login.
- For the provider: rotate all exposed production secrets and keys, upgrade every account to strong key-derivation iterations, and encrypt previously plaintext fields like URLs.
- Assume stolen encrypted vaults will be cracked offline over time, and prioritize rotation by sensitivity rather than treating the data as safe.
Comment l’éviter
- Use a long, unique master password (or passkey) and the strongest available key-derivation settings; once a vault is stolen, that strength is the only thing protecting it.
- Separate engineers' work and personal devices, and never let a personal machine hold access to production keys.
- Tightly restrict and monitor the few people with crown-jewel access, and require hardened, managed endpoints for them.
- Encrypt every field in sensitive data, not just the obvious ones; the unencrypted vault URLs were themselves a damaging leak.
- Rotate all secrets and keys immediately on any exposure, and assume stolen encrypted data will eventually be cracked.
Références
- https://www.bleepingcomputer.com/news/security/lastpass-devops-engineer-hacked-to-steal-password-vault-data-in-2022-breach/
- https://krebsonsecurity.com/2023/09/experts-fear-crooks-are-cracking-keys-stolen-in-lastpass-breach/
- https://krebsonsecurity.com/2025/03/feds-link-150m-cyberheist-to-2022-lastpass-hacks/
- https://nvd.nist.gov/vuln/detail/CVE-2020-5741
- https://en.wikipedia.org/wiki/2022_LastPass_data_breach
Vulnérabilités liées
Tout OpSec →- CRITICALOPSEC-MIDNIGHT-BLIZZARD-2024
In January 2024, Microsoft revealed that Russia's foreign-intelligence service, the same APT29 behind SolarWinds, had been reading the email of its senior leadership. The way in was almost insulting in its simplicity: a forgotten, non-production test account with a weak password and no MFA. The attackers guessed the password by spraying common ones across many accounts, then pivoted through a forgotten over-privileged application to grant themselves access to corporate mailboxes, including those of executives and the security and legal teams. It is the lesson that your security is only as strong as the account you forgot about, and that even Microsoft's perimeter fell to a missing MFA checkbox.
- HIGHOPSEC-TWILIO-2022
On 7 August 2022, Twilio, a company whose entire business is sending text messages and verification codes for other companies, was breached through text messages. Attackers ran an SMS phishing campaign against Twilio's own employees, texting them fake "your password expired" alerts from numbers that looked like Twilio IT and linking to convincing fake login pages. Several staff entered their credentials, handing over access to internal tools and the data of more than 200 customers, and rippling downstream to users of the secure-messaging app Signal. It was one strike in a sprawling campaign, dubbed 0ktapus, that phished around 130 companies the same way. It is the lesson that phishing-resistant MFA exists for a reason: ordinary credentials and codes can always be talked out of a human.
- HIGHOPSEC-INTERNET-ARCHIVE-2024
The Internet Archive, the nonprofit behind the Wayback Machine, had a brutal October 2024: a data breach, a website defacement, and a wave of DDoS attacks, all at once. Underneath the chaos was an unglamorous root cause. An authentication token sat in plain text in a public config file; the team rotated it repeatedly, but each new token landed right back in the same exposed file, so the leak never actually closed. With it, an attacker downloaded the source code, found more credentials hardcoded inside, and walked out with a database of 31 million users. Weeks later a second token from that same stolen code, for the support system, exposed 800,000 support tickets, some with people's ID documents. It is the lesson that rotating a secret is useless if it goes straight back into a public file, and that one leak unravels everything.
- CRITICALOPSEC-SNOWFLAKE-2024
In mid-2024, a single gap, accounts without multi-factor authentication, turned into one of the largest waves of data theft ever, hitting Ticketmaster, AT&T, Santander, and around 165 other companies at once. The attackers never broke Snowflake, the cloud data platform all of them used. They simply logged in with valid usernames and passwords, harvested months or years earlier by infostealer malware from employees' personal computers and bought on criminal markets. Where MFA was not turned on, a stolen password was a full key. It is the defining lesson of the infostealer era: your breach can start on an employee's home laptop, and MFA is the difference between a leaked password and a catastrophe.
- HIGHOPSEC-MERCEDES-BENZ-2024
Publicly disclosed January 30, 2024, a Mercedes-Benz employee accidentally committed a GitHub authentication token to a public repository, leaving it exposed from September 29, 2023. RedHunt Labs found the token during an internet-wide scan; it granted unrestricted, unmonitored access to Mercedes-Benz's internal GitHub Enterprise Server, allowing anyone to download private source-code repositories that could contain API keys, cloud access keys, database connection strings, blueprints, and SSO passwords. After notification, the token was revoked on January 24, 2024. Mercedes-Benz stated customer data was not affected but could not confirm whether anyone besides the researchers accessed the repositories during the exposure window.
- HIGHOPSEC-OKTA-2023
Okta is an identity provider: the single front door thousands of companies use to log their employees into everything. So when Okta's customer-support system was breached in late 2023, the blast radius was a who's-who of security-conscious companies. The entry point was almost mundane. An employee had signed into their personal Google account on an Okta laptop and saved a corporate service-account password into it; the attacker got that password and walked into Okta's support system. There they downloaded diagnostic files that customers had uploaded, some of which contained live session tokens, and used those tokens to step directly into the customers' own Okta environments. It is the lesson that session tokens are as good as passwords, support systems are production systems, and a personal browser profile can be the crack in the wall.