GoTo says hackers stole encrypted LastPass back-ups and keys

The latest breach in November was already pretty bad — turns out it was much worse.

Credit: Dreamstime

It's been almost two months since LastPass owner GoTo confirmed that its company had been hacked in November of last year, exposing user data for a number of its security- and access-focused products.

But hackers also breached GoTo's other products: Central, Pro,, Hamachi, and RemotelyAnywhere. In an update concerning those breaches yesterday, GoTo gave more info that's cause for concern: in addition to taking encrypted data from a shared third-party server, the hackers managed to get the encryption key, too.

The LastPass hack was already fairly devastating for a company that's all about securing users' data. Previously we knew that usernames and passwords, as well as billing info, email addresses, phone numbers, and IP addresses were stolen.

The update says that in addition to all of that, more usernames and passwords (including salted and hashed passwords), multi-factor authentication settings, and licensing info was taken from users of Central, Pro,, Hamachi, and RemotelyAnywhere. GoToMyPC and Rescue support databases were, apparently, not stolen, nor were credit card numbers.

The update doesn't say how many users were affected, in fact, GoTo hasn't given that information at all so far. But the post says that "we are contacting affected customers directly and recommending steps to protect their account info".

Affected users' passwords on the related GoTo products have been reset by the company. User accounts are being migrated to an enhanced Identity Management Platform with more robust security.

The update is the latest in a string of embarrassing news for GoTo and LastPass. The November hack follows a similar event in August of last year, apparently related, and in the combined breaches both internal company information and customer data was compromised.

Join the newsletter!


Sign up to gain exclusive access to email subscriptions, event invitations, competitions, giveaways, and much more.

Membership is free, and your security and privacy remain protected. View our privacy policy before signing up.

Error: Please check your email address.

Tags LastPasscyber securityGoTo

Keep up with the latest tech news, reviews and previews by subscribing to the Good Gear Guide newsletter.
Michael Crider

Michael Crider

PC World (US online)
Show Comments

Most Popular Reviews

Latest Articles


PCW Evaluation Team

Cate Bacon

Aruba Instant On AP11D

The strength of the Aruba Instant On AP11D is that the design and feature set support the modern, flexible, and mobile way of working.

Dr Prabigya Shiwakoti

Aruba Instant On AP11D

Aruba backs the AP11D up with a two-year warranty and 24/7 phone support.

Tom Pope

Dynabook Portégé X30L-G

Ultimately this laptop has achieved everything I would hope for in a laptop for work, while fitting that into a form factor and weight that is remarkable.

Tom Sellers


This smart laptop was enjoyable to use and great to work on – creating content was super simple.

Lolita Wang


It really doesn’t get more “gaming laptop” than this.

Featured Content

Product Launch Showcase

Don’t have an account? Sign up here

Don't have an account? Sign up now

Forgot password?