LastPass admitted that the attacker behind the August breach used the stolen information to target an employee and copied a backup of customer vaults from a third-party cloud storage service. The November 30 notice had only admitted that the attackers got in again. Usernames, passwords, secure notes and form data are encrypted with the master password, but website URLs are stored in plaintext: a convenient target list for phishing. LastPass’s own notice says customers who kept the defaults (a master password of at least 12 characters and 100,100 iterations) need to take no action, while everyone else should consider changing the passwords stored in their vault. Older accounts may still be set to 5,000 PBKDF2 iterations, and Markuta shows how to pull a vault from the browser extension and crack a weak master password offline with hashcat mode 6800. Announcing all this three days before Christmas is certainly one way to keep the news cycle quiet.
Update 2023-01-20: A follow-up looks at Wladimir Palant’s analysis of this statement and at accounts stuck on far fewer iterations.