[bombita]

Another data point, same deal.

  Time Monday, December 27, 2021 at 1:29 PM EST
  Location São Paulo, SP 01323, BRAZIL
  IP address 160.116.231.145

Went ahead and deleted my Lastpass account and changed my password in other password managers.

[gregsadetsky]

Holy moly!!!

Were you using LastPass around 2017? One theory that's floating is that we were all owned by a compromised LastPass extension 4-5 years ago.

Just trying to find some common thread among all of us (a thread that's different than "lastpass was owned" which presumably should be more improbable...)

[kevinslashslash]

I got the "Someone just used your master password" email too

Time Monday, December 27, 2021 at 3:05 PM EST Location São Paulo, SP 01323, BRAZIL IP address 160.116.190.69

I haven't used LastPass since 2016 or 2017.

[gregsadetsky]

Thanks for this additional confirmation/data point!

Something clearly happened around 2017 to all of us... And to see the same ip range today come up again and again is really troubling.

[bombita]

Actually that can very much be the case. Just checked and I signed up for it on Sun, 4 Jun 2017, 08:17, which fits the breach (not sure what was the exact date on it)