Security News > 2023 > January > GoTo now says customers’ backups have also been stolen

GoTo has confirmed on Monday that attackers have stolen customers' encrypted backups from a third-party cloud storage service related to its Central, Pro, join.

The attackers have also managed to grab an encryption key for a portion of the encrypted backups.

In early December, LastPass and its affiliate GoTo made public a security incident involving the third-party cloud storage service both companies use, as well as GoTo's development environment.

Now GoTo disclosed that the cloud storage service compromise had more far-reaching consequences.

"The affected information, which varies by product, may include account usernames, salted and hashed passwords, a portion of Multi-Factor Authentication settings, as well as some product settings and licensing information. In addition, while Rescue and GoToMyPC encrypted databases were not exfiltrated, MFA settings of a small subset of their customers were impacted," GoTo CEO Paddy Srinivasan shared.

The good news is that attackers could not have grabbed full credit card or bank details and customers' Social Security numbers, but that will likely be cold comfort to those customers who have had their backups stolen.

News URL

https://www.helpnetsecurity.com/2023/01/24/goto-customers-backups-stolen/