LastPass also revealed that the website URL is not encrypted within the vault, only the username, password, and notes fields are.Since the threat actor has an offline copy of the encrypted vault, UC San Diego multi-factor authentication would not protect against such brute-force cracking.While the stolen password vaults are encrypted with each user’s master password, there is a possibility the master password could be cracked and decrypted over time via brute-force methods, with master passwords that are shorter in length being more vulnerable.We don’t know if a subset or all of their customers are affected, but we are assuming the worst-case scenario.However, late last year, LastPass announced that customer information (company names, end-user names, billing addresses, email addresses, telephone numbers, and the IP addresses) and encrypted password vaults were stolen. At that time, LastPass reported no impact to customer information and no impact to customer password vaults. LastPass, UC San Diego’s recommended password manager, experienced a cybersecurity incident in August 2022. Recommended actions to take regarding stolen LastPass customer information and encrypted password vaults.

Last pass safety