![\"LastPass](\"https:\/\/www.newsbeep.com\/uk\/wp-content\/uploads\/2025\/12\/1765733295_975_0x0.jpg\")
<\/p>\n<\/p>\n
LastPass fined $1.6 million over insufficient security measures.<\/p>\n
SOPA Images\/LightRocket via Getty Images<\/p>\n
Updated December 14 with details of how to check if any of your passwords have been compromised following news of 630 million stolen credentials released by the FBI, alongside the original reporting regarding the LastPass data breach investigation and fine.<\/p>\n
Any data breach affecting 1.6 million people is big news, especially when it involves one of the most prominent password managers out there: LastPass. The U.K. Information Commissioner\u2019s Office has just fined LastPass \u00a31.2 million ($1.6 million) for failing to \u201cimplement sufficiently robust technical and security measures, which ultimately enabled a hacker to gain unauthorised access to its backup database.\u201d Here\u2019s what you need to know.<\/p>\n
ForbesMicrosoft Worm Attack Warning \u2014 Act Rapidly And Change Passwords NowBy Davey Winder<\/a>Breach Investigation Reports LastPass Failed Customers, Leaving Them Vulnerable<\/p>\n LastPass is one of the best-known password managers, with a consumer user base of over 20 million and 100,000 businesses relying on its services. Perhaps unsurprisingly, then, it is also a prime target for cybercriminals \u2014 from a company network intrusion confirmed by LastPass<\/a> in 2015 through to the latest warnings for users against opportunistic \u201care you dead<\/a>\u201d master password hack attacks on users. <\/p>\n In 2022, LastPass CEO Karim Toubba announced that an unauthorized party<\/a> had gained access to “certain elements of our customers\u2019 information,\u201d which sent shivers up the spines of cybersecurity experts and users alike. That 2022 data breach, concerning a third-party cloud storage service, has now come back to bite the business. The U.K. Information Commissioner\u2019s Office, an independent regulatory body that upholds data privacy protections, confirmed it fined LastPass a total of \u00a31.2 million ($1.6 million) for the breach that impacted 1.6 million U.K. users alone. <\/p>\n LastPass \u201cwhich promises to help people improve their security,\u201d the ICO said<\/a>, \u201chas failed them, leaving them vulnerable.\u201d<\/p>\n Although there remains no evidence that the hackers were able to decrypt customer passwords, the ICO concluded that \u201cLastPass failed to implement sufficiently robust technical and security measures, which ultimately enabled a hacker to gain unauthorised access to its backup database.\u201d Despite these failings, LastPass passwords were not affected, and using a password manager remains a recommended security measure for most users.<\/p>\n ForbesGoogle Confirms Critical No Password Required Attack \u2014 Act NowBy Davey Winder<\/a>Why You Still Need LastPass And Other Password Management Apps<\/p>\n Although the knee-jerk reaction to hearing that any password manager service has fallen victim to a significant security incident, no matter how that occurred or the data involved, is to immediately think that putting all your password eggs into a single application basket is a bad idea, users need to stop and think before taking any rash acts that could, in reality, leave them and their accounts less secure as a result. Sure, it\u2019s devastating to learn that the password manager you have entrusted your secrets to has been left wanting when it comes to its own security, but the fact of the matter here is that no LastPass passwords were exposed, nor could they have been by this attack on the third-party supplier concerned. Not managing your passwords is a much riskier option, and one that will almost always lead to less secure password construction and use, including password reuse across sites and ease of recollection taking precedence over randomness, complexity, and strength.<\/p>\n If you want solid evidence of why this is the case, then look no further than the news that the FBI has just released a database of 630 million stolen passwords<\/a> that were discovered on devices belonging to a single hacker. The compromised passwords were sourced by the cybercriminal, whose devices were seized during the course of an investigation, from a variety of places that included dark web marketplaces, Telegram channels and infostealer<\/a> logs. <\/p>\n Password reuse, alongside weak password construction, will never be a good alternative to a password manager.<\/p>\n