OneLogin is an online password manager that allows you to have a single login for multiple sites, much like 1Password and LastPass. Part of the beauty of services like OneLogin is being able to securely store your passwords in one place but use a master password for everything. Unfortunately, nothing is 100% secure and the company has announced a security breach to which it doesn’t fully know the extent of.
Our review has shown that a threat actor obtained access to a set of AWS keys and used them to access the AWS API from an intermediate host with another, smaller service provider in the US. Evidence shows the attack started on May 31, 2017 around 2 am PST. Through the AWS API, the actor created several instances in our infrastructure to do reconnaissance. OneLogin staff was alerted of unusual database activity around 9 am PST and within minutes shut down the affected instance as well as the AWS keys that were used to create it.
The threat actor was able to access database tables that contain information about users, apps, and various types of keys. While we encrypt certain sensitive data at rest, at this time we cannot rule out the possibility that the threat actor also obtained the ability to decrypt data. We are thus erring on the side of caution and recommending actions our customers should take, which we have already communicated to our customers.
The company says they are investigating further and are involving law enforcement. At this point, there’s not a whole lot you can do except start changing passwords on all of your accounts stored in OneLogin. If the hackers do have the ability to decrypt, then your encrypted passwords are at risk. Unfortunately, this is the world we live in and if you want to be part of the online world, these are the risks involved. There are really no completely secure methods from keeping hackers from user data, you can only mitigate the risks.