Reprinted from TidBITS by permission; reuse governed by Creative Commons
license BY-NC-ND 3.0. TidBITS has offered years of thoughtful commentary
on Apple and Internet topics. For free email subscriptions and access to the
entire TidBITS archive, visit http://www.tidbits.com/


               Additional GoTo Data Stolen in the LastPass Breach

   Adam Engst

   On the blog of remote collaboration and IT software company GoTo, CEO
   [1]Paddy Srinivasan writes:

     Our investigation to date has determined that a threat actor
     exfiltrated encrypted backups from a third-party cloud storage
     service related to the following products: Central, Pro, join.me,
     Hamachi, and RemotelyAnywhere. We also have evidence that a threat
     actor exfiltrated an encryption key for a portion of the encrypted
     backups. The affected information, which varies by product, may
     include account usernames, salted and hashed passwords, a portion of
     Multi-Factor Authentication (MFA) settings, as well as some product
     settings and licensing information. In addition, while Rescue and
     GoToMyPC encrypted databases were not exfiltrated, MFA settings of a
     small subset of their customers were impacted.

   If that sounds bad, it is. And if it sounds familiar, that's because
   GoTo owns LastPass, and these backups stolen were part of the theft of
   LastPass's password vaults (see '[2]LastPass Shares Details of Security
   Breach,' 24 December 2022). GoTo says it is contacting affected
   customers directly to recommend actionable steps to secure their
   accounts, and it will reset the passwords and MFA settings of affected
   users. Regardless, if you use any GoTo services, we recommend you reset
   your passwords, reset or enable multi-factor authentication, and verify
   that no extra user accounts have been added. And, frankly, consider
   moving to other services.

References

   1. https://www.goto.com/blog/our-response-to-a-recent-security-incident
   2. https://tidbits.com/2022/12/24/lastpass-shares-details-of-connected-security-breaches/

.