LastPass Developer Breach Took 14 Repositories Four Months Before the Vault Theft

In August 2022 an unauthorised party reached portions of the LastPass development environment through a single compromised developer account. Reporting describes activity limited to a four-day window, an AWS GuardDuty alert on 11 August, and public disclosure on 25 August.

What was taken is reported as 14 source code repositories, technical documentation, and an encrypted copy of the key protecting production database backups in cloud storage — which the attacker was not in a position to decrypt. The company stated that no customer data and no encrypted vaults were accessed.

Every statement the company made in August appears to have been accurate. No vaults, no customer data, a bounded four-day window, detection by an automated alert.

In December the same company disclosed that attackers had taken encrypted vault backups for the entire customer base, using information from this intrusion to get there — the file at 22-1222. The August incident was not a small incident that grew. It was reconnaissance whose value was realised later, and no scoring scheme this desk uses could have registered that at the time.

Source code and internal technical documentation describe where things are kept, how they are protected, which keys guard which stores and what the recovery paths are.

We filed stolen code as a diffuse, uncountable harm at 22-0322. This is the concrete version: the material was used. It also explains why the encrypted key mattered even though it could not be decrypted — knowing that a specific key protects a specific backup store tells an attacker exactly which human being to go after, which is what happened.

The reported entry was a single compromised developer account in the development environment.

We keep arriving here — 22-1101, where a phished GitHub account reached 130 repositories; 22-0412, where a token cloned private code across dozens of organisations; 22-0524, where a synced browser password reached a corporate VPN. Development environments hold the description of production, and they are consistently governed as though they hold nothing.