“If I change my master password why do I need to change my account passwords?” Your master password is the only factor protecting your stolen vault contents. “Won’t DUO two-factor protect my account?” If you receive any two-factor prompts that you did not initiate, do not respond to them and contact Check your financial accounts regularly for any fraudulent transactions.Ĩ) Be on the lookout for phishing emails trying to steal your LastPass password or personal information!įor personal LastPass accounts, follow a similar course of action. Passwords must include 3 of the 4 character types (uppercase, lowercase, number, symbol).Ģ) Start changing the passwords for your stored accounts and prioritize your myBama account, email accounts, financial accounts, and other accounts that could cause significant harm to you or the University if stolen.ģ) If you store API keys or other similar application credentials, change those as well.Ĥ) If you store credit card numbers in LastPass, we suggest requesting a new card from your financial institution.ĥ) Continue changing all of your stored passwords.Ħ) Enable two-factor authentication on all services if possible. Consider using a pass phrase or at least five randomly selected words. This should be different from your myBama password. On January 4, 2023, at 2:00pm, OIT Security will configure LastPass to require all users to change their master passwords if they have not since December 21, 2022.ġ) Change your LastPass master password to include at least 14 characters. We recommend that you follow these steps, including changing your master password immediately. Cybercriminals who obtained copies of customer vaults in November 2022 and may be trying to crack these master passwords to access the passwords stored within. Your LastPass password vault is encrypted with a master password that only you know.

This attack affected a significant portion of the large LastPass customer base, including users at The University of Alabama. LastPass discovered that in November 2022, a copy of the customer password vaults had been stolen. On December 22, LastPass informed its customers of a potential cyber security incident that could compromise the passwords stored in their accounts. Many faculty, staff, and students utilize LastPass as a password management tool to store passwords in an encrypted environment. LastPass Breach – Password change required

Lastpass suggest password