LastPass Parent Company GoTo Suffers Data Breach, Customers’ Backups Compromised

Jan 25, 2023Ravie LakshmananData Breach / Remote Work Tool

LastPass-owner GoTo (formerly LogMeIn) on Tuesday disclosed that
unidentified threat actors were able to steal encrypted backups of
some customers’ data along with an encryption key for some of those
backups in a November 2022 incident.

The breach, which targeted a third-party cloud storage service,
impacted Central, Pro, join.me, Hamachi, and RemotelyAnywhere
products, the company said.

“The affected information, which varies by product, may include
account usernames, salted and hashed passwords, a portion of
multi-factor Authentication (MFA) settings, as well as some product
settings and licensing information,” GoTo’s Paddy Srinivasan
said^[1].

Additionally, MFA settings pertaining to a subset of its Rescue
and GoToMyPC customers were impacted, although there is no evidence
that the encrypted databases associated with the two services were
exfiltrated.

The company did not disclose how many users were impacted, but
said it’s directly contacting the victims to provide additional
information and recommend certain “actionable steps” to secure
their accounts.

GoTo has also taken the step of resetting the passwords of
affected users and requiring them to reauthorize MFA settings. It
further said it’s migrating their accounts to an enhanced identity
management platform that claims to offer more robust security.

The enterprise software provider emphasized that it does store
full credit card details and that it does not collect personal
information such as dates of birth, addresses, and Social Security
numbers.

The announcement comes nearly two months after both GoTo and
LastPass disclosed^[2]
“unusual activity within a third-party cloud storage service”
that’s shared by the two platforms.

LastPass, in December 2022, also revealed^[3]
that the digital burglary leveraged information stolen from an
earlier breach that took place in August and enabled the adversary
to steal a massive stash of customer data, including a backup of
their encrypted password vaults.

The obtained information was “used to target another employee,
obtaining credentials and keys which were used to access and
decrypt some storage volumes within the cloud-based storage
service,” it noted.