LastPass data breach: Someone sued password manager after losing Bitcoin – Times of India

LastPass is taking a lot of criticism from multiple quarters after it announced that hackers, who attacked the platform in August, have a copy of consumer data, including names, email addresses, billing addresses and telephone numbers. In the latest development, someone has filed a petition for a class action against LastPass for “its failure to exercise reasonable care in securing and safeguarding highly sensitive consumer data.”
Plaintiff “John Doe”, individually and on behalf of others similarly situated, has filed a class action lawsuit against LastPass following the data breach that was first reported in August 2022. Doe says that the data breach of password management service has resulted in the theft of around $53,000 worth of Bitcoin.

The plaintiff says that he “updated his master password to more than 12 characters using a password generator, thus complying with Defendant’s ‘best practices’ so that he could store the highly sensitive private keys associated with his Bitcoin purchases in his LastPass customer vault.”
Doe also claims he deleted his Private Information from his customer vault, however, on or around Thanksgiving weekend of 2022, his Bitcoin was stolen using the private keys he stored with LastPass.
LastPass is used by more than 30 million users and 85,000 businesses worldwide.
LastPass hack
In December, LastPass CEO Karim Toubba said that the hackers, who compromised the company’s cloud-based storage environment, stole source code and used it to target another employee of the company. From that employee, they were able to get cloud storage access keys and dual storage container decryption keys which were “used to access and decrypt some storage volumes within the cloud-based storage service.”

As per the top executive, the threat actors have access to customers’ names, end-user names, billing addresses, email addresses, telephone numbers, and the IP addresses from which customers were accessing the LastPass service.
CERT-In warning
Computer Emergency Response Team (CERT-In) issued an advisory warning Indian users that cybercriminals can undertake phishing attacks to compromise their accounts. on has issued an advisory.
Recently, several cybersecurity experts have criticised the company’s statement. One of the experts said that the “statement is full of omissions, half-truths and outright lies.” Another one says that “the claim of ‘zero knowledge’ [by the CEO] is a bald-faced lie.”