“The threat actor was able to capture the employee’s master password as it was entered, after the employee authenticated with MFA, and gain access to the DevOps engineer’s LastPass corporate vault.”
The keys to LastPass customer vault backups sat on one engineer’s home computer, next to a vulnerable media server package. A keylogger did the rest, and MFA didn’t matter. LastPass has over 30 million users and 100,000 corporate customers. Its fix is helping one employee secure a home network and telling everyone else to change all their passwords.