The hackers behind the LastPass breach are on a rampage two years after their initial attack
A major data breach at password manager firm
LastPass in 2022 is still causing mayhem two years later, with cyber criminals using stolen information to carry out further attacks.
According to data collated by crypto investigator ZachXBT, hackers
stole $12.38 million in cryptocurrency from LastPass users on 16 and 17 December.
The attackers drained nearly 150 individual victim addresses, according to the analysis, with ZachXBT noting the stolen money was quickly converted into different currencies and syphoned away.
“The stolen funds were swapped for ETH and transferred to various instant exchanges from
Ethereum to
Bitcoin,” ZachXBT wrote in his Telegram channel.
This activity is the most recent example of criminal activity linked to the 2022
LastPass breach, with cyber criminals stealing approximately $4.4 million from over 25 victims on 25 October 2023.
Breaking the news, ZachXBT
urged readers to move their cryptocurrencies if they might have been impacted by the LastPass incident.
“I cannot stress this enough, if you believe you may have ever stored your seed phrase or keys in LastPass, migrate your crypto assets immediately.”
Jamie Moles, senior technical manager at
ExtraHop, said the drawn out effects of cyber breaches are becoming all too familiar, noting it’s likely the true scale of the fallout associated with the incident is yet to be fully comprehended.
“This is just the most recent in an ongoing stream of
crypto thefts affecting victims of the LastPass breach. With this new information coming to light two years on , we can assume we still don’t understand the full extent of the damage,” he explained.
“The long-tail effects of hacks on even the most sophisticated organisations underscores how important it is to get cybersecurity right in the first place. We know that there are going to be new exploits and unknown threats coming at enterprise and public sector organisations. Using signatures and rules to detect known
attack vectors isn’t enough, and it hasn’t been for some time.”
www.itpro.com
