LastPass says some unauthorized login alerts were sent in error, no passwords were compromised

LastPass wants to assure its users that there has been no breach into its system. The statement follows reports that users were getting notified of unauthorized login attempts. Nikolett Bacso-Albaum, senior director of LogMeIn Global PR, initially said the alerts sent were related to "fairly common bot-related activity," involving malicious attempts to log into LastPass accounts using email and passwords bad actors sourced from past breaches of other third-party services. But they wanted to emphasize that the service wasn't compromised by an unauthorized party.

LastPass Vice President of Product Management Dan DeMichele sent a release to The Verge late Tuesday night with a detailed explanation of what happened, claiming at least some of the alerts were "likely triggered in error" because of an issue LastPass has now fixed.

Here's the complete statement:

As previously stated, LastPass is aware of and has been investigating recent reports of users receiving e-mails alerting them to blocked login attempts.

We quickly worked to investigate this activity and at this time we have no indication that any LastPass accounts were compromised by an unauthorized third-party as a result of this credential stuffing, nor have we found any indication that user’s LastPass credentials were harvested by malware, rogue browser extensions or phishing campaigns.

However, out of an abundance of caution, we continued to investigate in an effort to determine what was causing the automated security alert e-mails to be triggered from our systems.

Our investigation has since found that some of these security alerts, which were sent to a limited subset of LastPass users, were likely triggered in error. As a result, we have adjusted our security alert systems and this issue has since been resolved.

These alerts were triggered due to LastPass’s ongoing efforts to defend its customers from bad actors and credential stuffing attempts. It is also important to reiterate that LastPass’ zero-knowledge security model means that at no time does LastPass store, have knowledge of, or have access to a users’ Master Password(s).

We will continue to regularly monitor for unusual or malicious activity and will, as necessary, continue to take steps designed to ensure that LastPass, its users and their data remain protected and secure.