Follow
This is bad.... Not the end of the world bad, but still bad. The attacker still needs to figure out individual master passwords to get your encrypted site passwords, but they have everything else.
Now to convince my wife to change /everything/ to onePassword.
@0x56 
how fucking stupid!
' One LastPass dev had access to this internal dev vault and was allowed to install Plex, which had a major security vulnerability. The hackers installed a keylogger onto that developer's PC and extracted that dev's Master Password and MFA code to the LastPass internal vault. Thus, the LastPass internal vault was immediately decrypted. Because they stole that dev's Master Password + MFA. '
@0x56 🤔
' It's not clear if the Plex breach has any connection to the LastPass intrusions. Representatives of LastPass and Plex didn’t respond to emails seeking comment for this story '
This means it's far worse than we know at this point because they don't know either I suspect.