From there, the threat actor 'took portions of source code and some proprietary LastPass technical information.' LastPass said that master passwords, encrypted passwords and other data stored in customer accounts, and customers' personal information weren't affected. LastPass said a threat actor gained unauthorized access through a single compromised developer account to portions of the password manager's development environment. Authy said it has since removed unauthorized devices from those accounts. Depending on who those accounts belong to, that could be very bad. Authy said that the threat actor used its access to log in to only 93 individual accounts and enroll new devices that could receive one-time passwords. Given the passwords the threat actor has already obtained in previous breaches, these tokens may have been the only things preventing the takeover of more accounts. Authy says it stores two-factor authentication tokens for 75 million users. The compromises of Authy and LastPass are the most concerning of the new revelations. DoorDash is one of them, a company representative has told TechCrunch. Group-IB said on Thursday that at least 136 companies were phished by the same threat actor as Twilio. Authentication service Okta and secure messenger provider Signal, both recently said their data was accessed as a result of the Twilio breach. Further Reading Phishers who hit Twilio and Cloudflare stole 10k credentials from 136 othersThree companies - Twilio-owned Authy, password manager LastPass, and food delivery network DoorDash in recent days have all disclosed data breaches that appear to be related to the same activity.

Lastpass and yubikey