The hacker was able to infiltrate LastPass by first stealing source code and technical data from the company back in August. As a security measure, LastPass also requires a master password to be at least 12 characters long. However, LastPass says this would be incredibly hard to pull off if the customer had used a complex password. This could involve trying to guess it by using brute-force attacks. The problem is that the hacker could exploit various ways to obtain a customer’s master password. “As a reminder, the master password is never known to LastPass and is not stored or maintained by LastPass,” the company said.

To decrypt the data, the hacker would need the vault’s master password-something only the customer should know.

LastPass is emphasizing that the stolen vault data remains protected because it’s been secured with 256-bit AES encryption. The stolen vault data contained “fully-encrypted sensitive fields such as website usernames and passwords, secure notes, and form-filled data,” along with unencrypted website URLs. At the time, it remained unclear what user data was ensnared, but now LastPass is revealing that the breach is about as bad as it can get. The company supplied the update three weeks after it confirmed a breach that led to the hacker stealing customer information. The hacker looted the password data by copying a “backup of customer vault data” from an encrypted storage container during the intrusion, LastPass said (Opens in a new window) on Thursday. LastPass has lost a copy of customers’ encrypted password data to a hacker, who recently breached the company’s systems. How to Set Up Two-Factor Authentication.How to Record the Screen on Your Windows PC or Mac.How to Convert YouTube Videos to MP3 Files.How to Save Money on Your Cell Phone Bill.How to Free Up Space on Your iPhone or iPad.How to Block Robotexts and Spam Messages.

Lastpass encryption