LastPass developer systems hacked to steal source code

Password management firm LastPass was hacked last week, allowing threat actors to steal the company's source code and proprietary technical information.

The disclosure comes after BleepingComputer learned of the breach from insiders last week and reached out to the company on August 21st without receiving a response.

Sources told BleepingComputer that LastPass was breached last week, with employees scrambling to contain the attack. 

After requests for information, LastPass released a security advisory today confirming that the company was breached through a compromised developer account that was used to access the company's developer environment.

While LastPass says there is no evidence that customer data or encrypted password vaults were compromised, the threat actors did steal portions of their source code and "proprietary LastPass technical information."

"In response to the incident, we have deployed containment and mitigation measures, and engaged a leading cybersecurity and forensics firm," explains the LastPass advisory.

"While our investigation is ongoing, we have achieved a state of containment, implemented additional enhanced security measures, and see no further evidence of unauthorized activity."

LastPass has not provided further details regarding the attack, how the threat actors compromised the developer account, and what source code was stolen.

This is a developing story.