I use Lastpass for password management. With just one “master password” and two-factor authentication, I have secure access to all my passwords. After using them for almost 7 years, it came as a shock when I received an email last year notifying me about a breach of their systems.
An unknown “threat actor” accessed Lastpass’ development environment in August 2022, and obtained copies of customer data, such as names and billing addresses, as well as customer vault data which contains passwords and other sensitive information. Thankfully, the customer vault data was protected by 256-bit AES encryption, which makes it extremely difficult for the threat actor to access this information.
I’ve liked seeing the monthly email from their CEO updating customers on the investigation and what they’re doing to resolve the situation. Although I’d prefer more frequent updates, the public and personal accountability from the CEO is heartening.
What it taught me is if you’re in the business of protecting people or their assets—whether that be security services, banking, insurance, or passwords—what really matters is how you turn up when the boat capsizes. Obfuscating and hiding the problem is a sure way to erode trust. However, openly taking responsibility makes customers want to give you a second chance; even if there is a hell of a mess to clean up.