Security News > 2023 > January > GoTo admits: Customer cloud backups stolen together with decryption key
GoTo is a well-known brand that owns a range of products, including technologies for teleconferencing and webinars, remote access, and password management.
If you've ever used GoTo Webinar, GoToMyPC, or LastPass, you've used a product from the GoTo stable.
The company first reported, back in August 2022, that crooks had stolen proprietary source code, following a break-in into the LastPass development network, but not customer data.
The data grabbed in that source code robbery turned out to include enough information for attackers to follow up with a break-in at a LastPass cloud storage service, where customer data was stolen, ironically including encrypted password vaults.
The suggestion seems to be that, in the GoTo breach, the development network and cloud service intrusions happened at the same time, as though this was a single break-in that yielded two targets right away, unlike the LastPass scenario, where the cloud breach was a later consequence of the first.
GoTo has admitted that the crooks have had at least some users' account names, password hashes and an unknown set of "MFA settings" since at least the end of November 2022, close to two months ago.