a key engineer's home device is out of scope

what everyone assumed

You draw a security perimeter around the things you own and manage: the corporate laptop, the office network, the systems in scope for your audit. A personal computer at an employee’s house sits outside that line by definition. It is their device, their network, their software, and reaching into it feels both impractical and intrusive. The boundary is reasonable, because you cannot patch a machine you do not administer, and the audit does not ask you to.

what happened

The 2022 LastPass breach came in two connected acts. In August 2022, an attacker compromised a developer’s corporate environment and took source code and technical documentation, including an encrypted copy of a key used to protect backups. That intrusion was detected and contained, and it looked finished. Working from what they had learned, the attackers then identified a specific target: one of only four DevOps engineers who held the ability to decrypt production backups. They reached that engineer through their home computer, exploiting the unpatched vulnerability in Plex media software running on it, and installed a keylogger. When the engineer entered their master password after passing multi-factor authentication, it was captured.

how it surfaced

With the engineer’s captured credentials, the attackers reached an internal vault holding the keys to LastPass’s cloud backups, and exfiltrated backup copies of customer vault data. LastPass disclosed the scope in stages through late 2022 and into 2023. The stolen backups held customer vault data in a format where sensitive fields such as usernames and passwords remained encrypted with keys derived from each user’s master password, while some fields, including website URLs, were not encrypted, alongside customer names, email addresses, phone numbers, and some billing details. The encrypted material was only as safe as each user’s master password. The assumption retired itself at the point of entry: the vault theft traced back through a home computer running consumer media software, a device no corporate audit had ever seen.

Scope is defined by access, not by who owns the hardware.

If a person can reach your most sensitive systems, then every device that person authenticates from is in scope, including the one on their kitchen counter. An attacker follows the access, and the access does not stop at the office door.