LastPass discloses security incidents affecting development environment and customer vault data
LastPass disclosed a security incident in August 2022 involving unauthorized access to portions of its development environment and source code. In subsequent updates, LastPass reported additional details about a related incident involving a third-party cloud storage service and the theft of customer vault data and backups. The disclosures highlight how incidents at security vendors can create downstream risk and drive significant customer remediation and trust impacts.
First reported August 25, 2022Breachhigh overall confidence
Public updates describe incident scope but do not provide definitive public attribution.
CVEs and ATT&CK
No CVE or ATT&CK association is captured in this curated record.
Mitigations
Now
Enforce phishing-resistant MFA for all engineering, DevOps, and cloud administrative accessReduces the likelihood that stolen credentials can be used to access source code, cloud storage, or backups.
Soon
Rotate secrets and re-issue signing keys/tokens after compromise of development environmentsLimits persistence and downstream abuse of stolen tokens or keys.
Later
Harden backup storage with strong encryption, access segmentation, and anomaly detectionReduces the impact if cloud storage is accessed and improves detection of bulk data access.
Detection ideas
Detect anomalous access to source repositories and CI/CD systems
Alert on unusual cloning/download of large repositories, new OAuth/app tokens, and logins from rare geographies or devices.
Data sources: Source control audit logs, CI/CD audit logs, IdP sign-in logs
Detect bulk downloads from backup and cloud storage
Alert on high-volume reads/exports from backup buckets and unusual access by service accounts.
Data sources: Cloud storage access logs, DLP alerts, SIEM
