GoTo, the parent company of LastPass, suffers a data breach, compromising customers' backups

GoTo, the parent company of LastPass and the former LogMeIn, has acknowledged that unknown threat actors stole encrypted backups of some customers’ data along with an encryption key.

 

The company said the attack targeted a third-party cloud storage service and affected the products Central, Pro, join.me, Hamachi, and RemotelyAnywhere.

 

Account usernames, a portion of multi-factor Authentication (MFA) settings, salted and hashed passwords, product settings, and licensing data are examples of the affected information, which varies by product.

 

Additionally, a small portion of its Rescue and GoToMyPC customers had their MFA settings affected, though there is no proof that the encrypted databases linked to the two services were stolen.

 

The company did not say how many users were affected, but it did say it is contacting the victims directly to offer more details and suggest some "actionable steps" to secure their accounts.

 

GoTo has also reset the affected users’ passwords and mandated that they reconfirm their MFA settings. It added that it is moving its accounts to a more advanced identity management platform, which promises to provide stronger security.

 

The enterprise software provider emphasized that it does not collect personal data like dates of birth, addresses, and Social Security numbers and only stores full credit card details.

 

Nearly two months have passed since GoTo and LastPass revealed "unusual activity within a third-party cloud storage service" that the two platforms shared.