Thousands of LastPass users have been locked out of their accounts – here’s what to do if you’re affected
A number of LastPass users have reported struggling to access their accounts due to security upgrades from the company.
The issues began in May 2023, when the password manager announced some upcoming changes and warned users that they would have to log back into their accounts and reset their multi-factor authentication (MFA).
However, many users have reported being locked out of their accounts even after resetting their codes on their authenticator apps, such as Google Authenticator or even LastPass’ very own.
Lock-out
To make matters worse, affected users can’t even access LastPass support, since this requires logging in too. Instead, they are prompted to reset their authentication app over and over in the client, as the system fails to recognize the new codes users have set up as instructed.
As expected, users have been taking to Twitter and the LastPass community forum to vent their frustrations.
LastPass said that in-app messages and emails were sent out notifying customers to reset their MFA well in advance of the actual announcement to the security upgrades.
The company has since clarified what the security upgrades actually entail. It has now strengthened its Password-Based Key Derivation Function (PBKDF2), an algorithm “that makes it difficult for a computer to check that any 1 password is the correct master password during a compromising attack.”
The default minimum number of passwords iterations post-upgrade is now 600,000. In order to carry out this upgrade, LastPass says it was necessary to log users out of their accounts and require them to reset their MFA.
“You must log in to the LastPass website in your browser and re-enroll your MFA application before you can access LastPass on your mobile device again. You cannot re-enroll using the LastPass browser extension or the LastPass Password Manager app,” it further added.
LastPass was previously featured on our list of the best password manager solutions, but since users’ vaults were stolen via a series of breaches at the company, we took the decision to remove it.
The vaults were encrypted, and there was no indication that the threat actors managed to crack them – only if they managed to guess your master password could they gain access. However, other personal data that were stolen from customers, such as contact and billing information, were not encrypted.