Password managers are supposed to be the safest place for your logins, but even the companies guarding your passwords can get hacked. So if you’ve just received a breach notice from your own password manager, what should you do? Every time I recommend one, readers ask that exact question. Here’s the answer, and I hope you never need it.Even Password Managers Aren’t Hack-ProofLike any online service, a password manager is only as trustworthy as the company running it, and companies lose customer data all the time. Attackers can intercept data as it travels between your device and a company’s servers, or steal it straight from the cloud.Password managers are no exception. When LastPass’s servers were breached in 2022, hackers made off with customer data, and the company later agreed to a $24.5 million settlement with affected users. Even companies a password manager works with can put you at risk: In another incident, hackers breached a third-party service LastPass uses, stole OAuth tokens, and used them to grab customers’ names, email addresses, phone numbers, and home addresses.
Once your data ends up with a data broker or on a dark web forum, there’s no getting it back. That’s why choosing a password manager is ultimately a decision about which company you trust.Your Breach Response Plan, Step by StepSo the worst has happened: You’ve received a dreaded “security incident notification” from your password manager. Don’t panic. A breach doesn’t automatically mean your accounts are compromised.That’s because good password managers encrypt your vault, and most use a zero-knowledge design, meaning the company never knows (and can’t retrieve) your master password. Your master password never leaves your device. It unlocks your vault locally, not in the cloud. So even if hackers steal a copy of your vault, they can’t read it unless they crack your master password, and a strong one can take years to crack.Still, you shouldn’t wait to find out how strong yours really is. Here’s what to do:1. Find out what was stolen. Read the notice carefully. A breach that exposed only names and email addresses is very different from one in which hackers copied customers’ encrypted vaults.2. Change your master password. Make the new one long, unique, and unlike any password you’ve used anywhere else. If you need help, my colleague Neil Rubenking has a handy guide to creating a strong, memorable one. Keep in mind that a new master password protects your vault going forward, but it doesn’t relock any copies hackers may have already taken.3. Sign out everywhere, and check your devices. Log out of your password manager on every device, then log back in with your new master password. Review the list of devices connected to your account, which most password managers provide, and remove any you don’t recognize. While you’re there, check your security settings for recent changes you didn’t make.4. Change your most important passwords. Use your password manager to generate new passwords for the accounts that matter most, starting with your email (which can be used to reset everything else), then banking and other financial accounts. If the breach included encrypted vaults, this is the most important step on this list, so work through the rest of your accounts over the following days. Treat anything else stored in your vault as exposed too, including secure notes, crypto wallet recovery phrases, and backup codes.5. Turn on multi-factor authentication. Multi-factor authentication (MFA) makes a stolen password far less useful, because hackers would also need your second factor. Choose an authenticator app, a passkey, or a hardware security key over text-message codes, which can be intercepted. If your MFA codes are stored in the same password manager that was breached, consider moving them to a separate app.6. Watch for scams and leaks. Breach victims are prime targets for phishing emails that pose as their password manager, so be wary of any message asking you to “verify” your account or master password. And since criminals often trade stolen data on the dark web, check out my guide to obtaining dark web reports to see what’s out there about you.
Recommended by Our Editors
Should You Switch? How to Find a Safer OptionPassword managers do get hacked, but using one is still far safer than reusing the same password everywhere or writing your logins on Post-it notes. According to a recent CNET Group survey, more than 30% of people reuse passwords across sites, and fewer than 20% use a password manager to create and fill in their credentials. That’s a much bigger risk than a password manager breach.And if a breach leaves you unable to trust your current provider, you’re not stuck with it. The best password managers make it easy to export your vault from one app and import it into another. Just be sure to delete the export file once you’re done, because it usually contains all your passwords in plain, unencrypted text. Here’s my guide on the best way to switch password managers.
The Best Password Managers I’ve Tested
Whether you’re choosing your first password manager or replacing one, look to expert reviews. I’ve been reviewing password managers since 2021, and before I test any app, I send the company a list of questions about its privacy policy, whether it sells customer data, and how it secures customers’ passwords. I report the answers to those questions, along with my own hands-on testing, in each review.Once you’ve narrowed it down to a few options, dig into how each company protects your data. Look for zero-knowledge encryption, published independent security audits, strong MFA options, and an honest record of handling breaches. And read the privacy policy: If a company says it sells customer data, or doesn’t say how long it keeps your data after you delete your account, steer clear.NordPass and Proton Pass are our Editors’ Choice winners, and the services I recommend most highly. If you’d rather not pay, the free Apple Passwords app is built into iPhones, iPads, and Macs, and Android users can use Google Password Manager, which is built into Android and Chrome.Whichever you choose, a strong master password and MFA will do more to protect you than any company’s promises.
About Our Expert
Kim Key
Senior Writer, Security
Experience
I review privacy tools like hardware security keys, password managers, private messaging apps, and ad-blocking software. I also report on online scams and offer advice to families and individuals about staying safe on the internet. Before joining PCMag, I wrote about tech and video games for CNN, Fanbyte, Mashable, The New York Times, and TechRadar. I also worked at CNN International, where I did field producing and reporting on sports that are popular with worldwide audiences.In addition to the categories below, I exclusively cover ad blockers, authenticator apps, hardware security keys, and private messaging apps.
var facebookPixelLoaded = false;
window.addEventListener(‘load’, function() {
document.addEventListener(‘scroll’, facebookPixelScript);
document.addEventListener(‘mousemove’, facebookPixelScript);
});
function facebookPixelScript() {
if (!facebookPixelLoaded) {
facebookPixelLoaded = true;
document.removeEventListener(‘scroll’, facebookPixelScript);
document.removeEventListener(‘mousemove’, facebookPixelScript);
window.zdconsent.cmd.push(function() {
! function(f, b, e, v, n, t, s) {
if (f.fbq) return;
n = f.fbq = function() {
n.callMethod ? n.callMethod.apply(n, arguments) : n.queue.push(arguments)
};
if (!f._fbq) f._fbq = n;
n.push = n;
n.loaded = !0;
n.version = ‘2.0’;
n.queue = [];
t = b.createElement(e);
t.async = !0;
t.src = v;
s = b.getElementsByTagName(e)[0];
s.parentNode.insertBefore(t, s)
}(window, document, ‘script’, ‘//connect.facebook.net/en_US/fbevents.js’);
fbq(‘init’, ‘454758778052139’);
fbq(‘track’, “PageView”);
});
}
}
Click Here For The Original Source.
——————————————————–
