{"id":16654,"date":"2023-01-24T18:32:05","date_gmt":"2023-01-24T17:32:05","guid":{"rendered":"https:\/\/www.show.it\/goto-says-hackers-stole-encrypted-backups-mfa-settings\/"},"modified":"2023-01-24T18:32:05","modified_gmt":"2023-01-24T17:32:05","slug":"goto-says-hackers-stole-encrypted-backups-mfa-settings","status":"publish","type":"post","link":"https:\/\/www.show.it\/en\/goto-says-hackers-stole-encrypted-backups-mfa-settings\/","title":{"rendered":"GoTo Says Hackers Stole Encrypted Backups, MFA Settings"},"content":{"rendered":"

IT management software firm GoTo on Tuesday said an unidentified threat actor stole encrypted backups and an encryption key for a portion of that data during a 2022 breach that also affected its LastPass affiliate.<\/strong><\/p>\n

GoTo chief executive Paddy Srinivasan confirmed the security breach was far worse than originally reported and included the theft of account usernames, salted and hashed passwords, a portion of Multi-Factor Authentication (MFA) settings, as well as some product settings and licensing information.<\/p>\n

In a notice<\/a> posted online, Srinivasan the encrypted backups were related to multiple GoTo-owned software products:<\/p>\n

\u201cOur investigation to date has determined that a threat actor exfiltrated encrypted backups from a third-party cloud storage service related to the following products: Central, Pro, join.me, Hamachi, and RemotelyAnywhere<\/em>.\u00a0<\/p>\n

We also have evidence that a threat actor exfiltrated an encryption key for a portion of the encrypted backups. The affected information, which varies by product, may include account usernames, salted and hashed passwords, a portion of Multi-Factor Authentication (MFA) settings, as well as some product settings and licensing information.\u00a0<\/em><\/p>\n

In addition, while Rescue and GoToMyPC encrypted databases were not exfiltrated, MFA settings of a small subset of their customers were impacted.\u201d<\/em>\u00a0<\/p>\n

Srinivasan said the company has no evidence of exfiltration affecting any other GoTo products or any of GoTo\u2019s production systems.<\/p>\n

Even though all account passwords were salted and hashed in accordance with best practices, Srinivasan said GoTo plans to reset the passwords of affected users and\/or reauthorize MFA settings where applicable.\u00a0<\/p>\n

\u201cIn addition, we are migrating their accounts onto an enhanced Identity Management Platform, which will provide additional security with more robust authentication and login-based security options,\u201d the GoTo CEO said.\u00a0<\/p>\n

In August last year, GoTo affiliate LastPass disclosed a data breach<\/a> that included the theft of source code and proprietary technical information.\u00a0 In November, GoTo said it was also affected<\/a> by that hack, which is linked to an unnamed third-party cloud security vendor.<\/p>\n

In a worrisome update in late December, the password management outfit admitted the hackers behind the August breach stole a massive stash of customer data, including password vault data that could be exposed by brute-forcing or guessing master passwords.<\/p>\n

LastPass said the hackers broke into its network in August<\/a> and used information from that hack to return and hijack customer data that included company names, end-user names, billing addresses, email addresses, telephone numbers, and the IP addresses from which customers were accessing the LastPass service.\u00a0\u00a0<\/p>\n

In addition, the unidentified actor was also able to copy a backup of customer vault data from an encrypted storage container.<\/p>\n

The exposed container contained both unencrypted data, such as website URLs, as well as fully-encrypted sensitive fields such as website usernames and passwords, secure notes, and form-filled data.<\/p>\n

Related: LastPass Says Password Vault Data Hijacked in Data Breach<\/a><\/strong><\/p>\n

Related: LastPass Source Code Stolen in Data Breach<\/a><\/strong><\/p>\n

Related: GoTo, LastPass Notify Customers of New Data Breach Related to Previous Incident<\/a><\/strong><\/p>\n

Related: LastPass Found No Code Injection Attempts Following August Data Breach<\/a><\/strong><\/p>\n

The post GoTo Says Hackers Stole Encrypted Backups, MFA Settings<\/a> appeared first on SecurityWeek<\/a>.<\/p>\n","protected":false},"excerpt":{"rendered":"

IT management software firm GoTo on Tuesday said an unidentified threat actor stole encrypted backups and an encryption key for a portion of that data during a 2022 breach that also affected its LastPass affiliate. GoTo chief executive Paddy Srinivasan confirmed the security breach was far worse than originally reported and included the theft of […]<\/p>\n","protected":false},"author":2,"featured_media":16655,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"_acf_changed":false,"footnotes":""},"categories":[82,76,86],"tags":[],"class_list":["post-16654","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-data-breach","category-data-breaches","category-lastpass"],"acf":[],"_links":{"self":[{"href":"https:\/\/www.show.it\/en\/wp-json\/wp\/v2\/posts\/16654","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.show.it\/en\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.show.it\/en\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.show.it\/en\/wp-json\/wp\/v2\/users\/2"}],"replies":[{"embeddable":true,"href":"https:\/\/www.show.it\/en\/wp-json\/wp\/v2\/comments?post=16654"}],"version-history":[{"count":0,"href":"https:\/\/www.show.it\/en\/wp-json\/wp\/v2\/posts\/16654\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/www.show.it\/en\/wp-json\/wp\/v2\/media\/16655"}],"wp:attachment":[{"href":"https:\/\/www.show.it\/en\/wp-json\/wp\/v2\/media?parent=16654"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.show.it\/en\/wp-json\/wp\/v2\/categories?post=16654"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.show.it\/en\/wp-json\/wp\/v2\/tags?post=16654"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}