Our investigation determined that the threat actor gained access to the Development environment using a developer’s compromised endpoint. We can also confirm that there is no evidence that this incident involved any access to customer data or encrypted password vaults. There is no evidence of any threat actor activity beyond the established timeline.

During this timeframe, the LastPass security team detected the threat actor’s activity and then contained the incident. Our investigation revealed that the threat actor’s activity was limited to a four-day period in August 2022. We have completed the investigation and forensics process in partnership with Mandiant.

I wanted to update you on the conclusion of our investigation to provide transparency and peace-of-mind to our consumer and business communities. On August 25 th, 2022, we notified you about a security incident that was limited to the LastPass Development environment in which some of our source code and technical information was taken. Update as of Thursday, September 15, 2022

Lastpass password manager breach