> series: anatomy_of_a_breach —— part: 078 —— target: lastpass —— stolen: auth_hashes_email_addresses —— trust_model: challenged<span class="cursor-blink">_</span>_
On 15 June 2015, LastPass disclosed that it had discovered and blocked suspicious activity on its network. The investigation revealed that attackers had accessed email addresses, password reminders, server per-user salts, and authentication hashes. LastPass stated that the encrypted password vaults — the core data that users trusted LastPass to protect — were not accessed, and that the master password hashing (using PBKDF2-SHA256 with 100,000 iterations) would make brute-forcing the authentication hashes extremely difficult for users with strong master passwords.
The 2015 breach was, in isolation, well-handled — LastPass detected it quickly, disclosed transparently, and the encrypted vaults were not stolen. But it raised a fundamental question that the security industry had been debating since password managers became mainstream: what happens when the vault that holds all your passwords is the target? The question would be answered definitively in 2022, when LastPass suffered a far more serious breach in which encrypted vaults were stolen — and the security of users' master passwords became the only defence.
We'll scope your test for free and tell you exactly what you need. No obligation, no hard sell.
Free Scoping CallPassword managers solve the credential reuse problem that has powered breaches throughout this series — from LinkedIn to Adobe to the credential dump summer. By generating and storing unique, strong passwords for every service, they break the reuse chain. But they create a new risk: the password vault becomes the single point of failure. If the vault is compromised, every credential it contains is at risk.
The LastPass breach teaches that security tools are themselves targets — and must be secured with the same rigour as the assets they protect. For organisations, this means: enable MFA on password managers, ensure master passwords are strong and unique, evaluate the security architecture of any centralised credential store, and maintain the ability to rotate all credentials if the vault is compromised.
Cyber Essentials mandates strong authentication controls. Our penetration testing assesses credential management practices and enterprise password vault security. Dark web monitoring through SOC in a Box detects when your credentials appear in breach datasets. And UK Cyber Defence provides incident response when credential compromise is detected.
<a href="/cyber-essentials">Cyber Essentials</a> mandates MFA. Our <a href="/penetration-testing">penetration testing</a> assesses credential management. <a href="https://www.socinabox.co.uk">SOC in a Box</a> monitors for credential compromise.
We'll scope your test for free and tell you exactly what you need. No obligation, no hard sell.
Free Scoping Call