Documented incidentDisclosed 2023-03-01LastPassEngineering postmortem

Attack on a senior DevOps engineer's computer leads to theft of cloud backups (LastPass, 2022-2023)

LastPass said an attacker exploited vulnerable third-party software to target a senior DevOps engineer.

What happened

  • The attacker obtained access to cloud-based backup storage containing configuration data, API secrets and encrypted customer vault data.Security Incident Update and Recommended Actions
  • LastPass rotated secrets, analysed its storage resources and added access controls.Security Incident Update and Recommended Actions

The failure pattern

Weak or phishable authentication on a privileged pathA password, an SMS code or a help-desk reset is all that stands between an attacker and admin access.How to prevent it Insufficient segmentation lets a foothold spreadOne compromised account, vendor or network segment reaches management planes, backups and everything else.How to prevent it
Watch the pattern: Weak or phishable authentication on a privileged path

Safeguards that address it

CollectSEA's engineering analysis of what would have prevented or contained this failure.

  • Separate privileged engineering access from personal environmentsRequire managed, hardened devices for anyone who can reach production backups or keys.
  • Limit and segment access to backup storageRestrict who can read backups, log access and keep decryption material out of the same reach.

Related standards

CollectSEA's mapping through this incident's failure pattern; not an official determination by the standards bodies.

Building something similar?

Describe your design and see every precedent that applies, with safeguards you can hand to your coding agent.

Analyze your design

Incidents with the same pattern