LastPass data breach led to $53K in Bitcoin stolen, lawsuit alleges

A people enactment suit has been filed against password absorption work LastPass pursuing a information breach from Aug. 2022.

The people enactment was filed with the U.S. territory tribunal of Massachusetts connected Jan. 3, by an unnamed plaintiff known lone arsenic “John Doe” and connected behalf of others likewise situated.

It alleges that the information breach of LastPass has resulted successful the theft of astir $53,000 worthy of Bitcoin.

The plaintiff claimed helium began accruing BTC successful Jul. 2022 and updated his maestro password to much than 12 characters utilizing a password generator, arsenic recommended by the LastPass “best practices.”

This was done to alteration the retention of backstage keys successful the seemingly unafraid LastPass lawsuit vault.

When quality of the information breach broke, the plaintiff deleted his backstage accusation from his lawsuit vault. LastPass was hacked successful Aug. 2022, with the attacker stealing encrypted passwords and different data, according to a December connection from the company.

Despite the speedy enactment to delete the data, it appeared to beryllium excessively precocious for the plaintiff. The suit read:

“However, connected oregon astir Thanksgiving play of 2022, Plaintiff’s Bitcoin was stolen utilizing the backstage keys helium stored with Defendant [LastPass].”

“The LastPass Data Breach has, done nary responsibility of his own, exposed him to the theft of his Bitcoin and exposed him to continued risk,” it added.

The suit claims that victims person been enactment astatine accrued important hazard of aboriginal fraud and misuse of their backstage information, which whitethorn instrumentality years to manifest, discover, and detect.

LastPass is being accused of negligence, breach of contract, unjust enrichment, and breach of fiduciary duty, however, the fig sought successful damages was not specified.

Related: 'Third-party incident' impacted Gemini with 5.7 cardinal emails leaked

According to cybersecurity researcher Graham Cluley, the stolen data includes unencrypted accusation including institution names, idiosyncratic names, billing addresses, telephone numbers, email addresses, IP addresses, and website URLs from password vaults.

— Graham Cluley (@gcluley) January 4, 2023

In December, LastPass admitted that if customers had anemic Master Passwords, the attackers whitethorn beryllium capable to usage brute unit to conjecture this password, allowing them to decrypt the vaults.