LastPass Breach

What happened?

Recent news of a LastPass security incident (see and the notification email sent by LastPass may generate concern by Auburn users.

On December 22nd, LastPass notified its customers that an unauthorized third party had obtained a copy of the encrypted customer password vaults.

LastPass has said that the breach exposed unencrypted customer data (email addresses, website URLs, etc) and encrypted data (usernames and passwords). Based on what has been reported, there is probably no cause for immediate alarm assuming you have used a strong master password. The master password only exists on your computer or mobile device that uses LastPass and is never sent to LastPass.

The actual risk to you depends on several factors:


What should I do?

There are a handful of simple actions you can take now to mitigate any potential risk from the LastPass breach.

  1. Change your master password to a long and unique password or passphrase. This will stop any attempts to login to your LastPass account in the future if your current password does become compromised.
  2. Verify you have multi-factor authentication setup both on LastPass and on all critical sites (financial, email, social media, etc.).
  3. Check your security score in LastPass and follow recommendations to change duplicate passwords, short passwords, and any passwords reported in other breaches.
  4. Also consider generating new passwords for critical sites on an annual basis (the password manager eases the burden of doing this).
  5. Be aware of phishing attempts targeting you (spearphishing) based on the secondary data that was exposed (your email and the sites you saved passwords for).
  6. Review the LastPass recommendations linked below.


Additional Information: