Toubba said: “After initiating an immediate investigation, we have seen no evidence that this incident involved any access to customer data or encrypted password vaults. The Virginia Tech IT Security Office will continue to monitor information regarding this breach.The breach was notified by LastPass on 25 August, prior to the bank holiday weekend, but was first detected a fortnight earlier, said CEO Karim Toubba, when it spotted “some unusual activity within portions of the LastPass development environment”.

Password managers make it more practical to use strong passwords, but unfortunately, they are a rich target for bad actors, as seen with this case. Encryption and decryption happen in the local client software on individual devices - this is an important layer of protection that mitigates the risk in the event that vault secrets are ever compromised. LastPass architected their service so that they do not possess unencrypted secrets nor the keys to decrypt them. Students have been advised keep an eye out for phishing attempts and to turn on two-factor authentication when available. Virginia Tech also advised students to never use their university credentials for other websites and to avoid reusing passwords. If the LastPass account is tied to their university credentials, Virginia Tech has advised students against storing their university username and password(s) in LastPass. Virginia Tech recommends that students change all passwords for accounts that are stored in LastPass, including the master password for their account.

Lastpass breach