LastPass Hacked but did anyone notice...

LastPass was hacked, they took a bit more time than I would have expected to notify users to change "Master Passwords". Plenty of people have wrote about the breach and have praised LastPass for how it has handled the attack.

I wanted to see if they listed themselves in the security challenge! It is available now as a link at the bottom of the security challenge... here is the result:

"Great news! The usernames in your vault selected were tested and have not been involved in any known security breaches since this test was last run.
Next we'll show you your score and ways to improve your security."

I don't think that is accurate, as this is my test account for LastPass and it was involved in a breech they admit to.

China is no surprise.

What is the bigger story here? The fact that China actively is gathering intelligence in an offensive manner or that the same US government agency has been hacked previously and still fails to protect its data.

If you think for one second our government is not doing the same thing to china think again.

http://www.cnn.com/2015/06/04/politics/federal-agency-hacked-personnel-management/

This story is tiresome. In the private sector companies retain way to much useless data and present a massive footprint to attack. Including legacy systems left on and disregarded years after they are needed, network device logs for devices they are not mandated by compliance to retain and metadata they do not use.

While Metadata in some ways is the lifeblood of companies like Google, for many companies it's purely a liability.

Building a secure network must include reducing your surface area and data that is not needed nearline.

ES.