LastPass notifies users of yet another data breach • Hacker News Board

Re: LastPass notifies users of yet another data breach

#21

Post by khurs » Thu, Jun 25, 2026, 12:23 PM UTC

Lots more companies affected. Some more listed below:

>"Klue has not said how many of its hundreds of customers are affected. Several companies have come forward to confirm they had data stolen during the attack, including Gong, Jamf, HackerOne, Insurity, OneTrust, Recorded Future, Snyk, Sprout Social, and Tanium."

>Cybercrime group Icarus took credit for the breach, saying on its leak site that it will publish the stolen data on Monday if the company does not pay the hackers’ ransom."

https://techcrunch.com/2026/06/22/klue-hack-results-in-data-...

Re: LastPass notifies users of yet another data breach

#22

Post by chinathrow » Thu, Jun 25, 2026, 12:26 PM UTC

Sitting here with my KeepassX and being happy, again.

Re: LastPass notifies users of yet another data breach

#23

Post by stymaar » Thu, Jun 25, 2026, 12:27 PM UTC

zulban wrote: post #16

jagged-chisel wrote: post #9

How does anyone seriously trust LastPass anymore? Years ago, I was working for a company handling bank data. They were using LP immediately following a previous LP security incident and had no plans to migrate away.

A lot of people and orgs don't use security products for security. They use them for security theater. A vast majority of people, even many security people, will never hear about this breach. So LastPass still works great for them.

And it will continue until we can sue company being breached for criminal negligence. Should a single company executive be personally liable in these situations, the scale of the problem would be orders of magnitude less severe because they would spend the appropriate amount of effort to cover their damn ass.

Re: LastPass notifies users of yet another data breach

#24

Post by rpdillon » Thu, Jun 25, 2026, 12:29 PM UTC

TZubiri wrote: post #3

Using a password manager has 2 main tradeoffs and mistakes: 1- Tradeoff individual account risk, for systemic risk. You may argue password managers are safe, but few would argue that the risk model reduces the risk of individual password leaks more than the risk of all your passwords leaking. It's a tradeoff. 2- Cat and mouse security: There's a class of security decisions that work because they are new and different…

> The information accessed was limited to standard business contact information and related customer relationship management (CRM) data, including customer names, phone numbers, email addresses, and physical addresses, as well as support case data and sales-related data.

Re: LastPass notifies users of yet another data breach

#25

Post by farfatched » Thu, Jun 25, 2026, 12:30 PM UTC

jagged-chisel wrote: post #9

How does anyone seriously trust LastPass anymore? Years ago, I was working for a company handling bank data. They were using LP immediately following a previous LP security incident and had no plans to migrate away.

What's the risk, and does that change by moving to an alternative?

Companies deal with leaked secrets a lot. A company already using a password manager is ahead of the game.

Suppose they move to a competitor. That's a migration and training that someone has to drive. What do they gain? Another company that can also have exploits? Or they self-host, and now have to fund that, and still potentially get exploits?

Ultimately, this likely isn't that big of a deal for a company.

And they have to weigh it up against all the other things that they can be doing.

Re: LastPass notifies users of yet another data breach

#26

Post by stanac » Thu, Jun 25, 2026, 12:36 PM UTC

fusslo wrote: post #12

I'm sure this is worse than using lastpass in some way but for the past couple years I've just generated and forgotten 90% of my passwords. the final 10% I keep in a password manager. But if the service isn't really that important I just use the 'forgot my password' to change and generate a new password every time I need to login

This works if the account doesn't have 2FA. On my last side project app users can login only via email OTP. There are security downsides with that, someone can send phishing link and use OTP submitted to the fake site, but the app doesn't store anything sensitive (it's a game which tracks your progress) so I guess it's not a major security risk.

Re: LastPass notifies users of yet another data breach

#27

Post by fidotron » Thu, Jun 25, 2026, 12:37 PM UTC

jagged-chisel wrote: post #9

How does anyone seriously trust LastPass anymore? Years ago, I was working for a company handling bank data. They were using LP immediately following a previous LP security incident and had no plans to migrate away.

The one that amazes me is Okta.

OK their Mac UX is great, but given their rate of incidents how can you trust it?

Clearly this stuff is not actually bought based on track record.

Re: LastPass notifies users of yet another data breach

#28

Post by al_borland » Thu, Jun 25, 2026, 12:37 PM UTC

amenghra wrote: post #10

TZubiri wrote: post #3

Using a password manager has 2 main tradeoffs and mistakes: 1- Tradeoff individual account risk, for systemic risk. You may argue password managers are safe, but few would argue that the risk model reduces the risk of individual password leaks more than the risk of all your passwords leaking. It's a tradeoff. 2- Cat and mouse security: There's a class of security decisions that work because they are new and different…

Password managers (whether it's Lastpass or your browser's built-in password store) also protect against phishing since they tie passwords to domain names. I don't think password managers which store encrypted vaults are less safe than trying to have and juggle strong unique-per-domain passwords, even if you think that the password manager is becoming a target.

When they work… I finally gave up on 1Password as it has been getting worse and worse about actually autofilling for a few years. After all the Avengers turned into investors and the price increase was announced, I jumped ship. It felt like they were more worried about their ROI than the product. After 18 years of use, this was pretty disappointing.

Re: LastPass notifies users of yet another data breach

#29

Post by al_borland » Thu, Jun 25, 2026, 12:39 PM UTC

acheron wrote: post #11

TZubiri wrote: post #3

Using a password manager has 2 main tradeoffs and mistakes: 1- Tradeoff individual account risk, for systemic risk. You may argue password managers are safe, but few would argue that the risk model reduces the risk of individual password leaks more than the risk of all your passwords leaking. It's a tradeoff. 2- Cat and mouse security: There's a class of security decisions that work because they are new and different…

The article is about a marketing data breach, not passwords.

From a marketing perspective, a data breach of any kind looks horrible for a company whose entire job is keeping secrets safe.

Re: LastPass notifies users of yet another data breach

#30

Post by insanitybit » Thu, Jun 25, 2026, 12:39 PM UTC

This isn't great but it's not that big of a deal either. A lot of companies got bit by the Klue breach but it's not like your vaults are being accessed.