Password manager OneLogin suffers major hack

OneLogin

OneLogin positions itself as a security-enhancing tool, allowing its customers to sign on to multiple websites with a single shared identity.

"All customers served by our U.S. data center are affected; customer data was compromised, including the ability to decrypt encrypted data", according to the email.

OneLogin later updated its post about the latest security incident, saying the facts are subject to change as the incident is investigated, but revealed the method of attack. Staff were not aware of the breach until seven hours later at 9am PST and it was shut down within minutes.

The company says in its announcement that it has contacted affected users.

In other words, if you're a USA based OneLogin customer every bit of data you have stored with their services is open and accessible to the hackers.

Uber fires self-driving car chief at center of court case
Yoo writes that Levandowski's failure to comply with the court order constitutes a potential "breach" of the employment agreement. Levandowski, which accuse him of launching competing startups while at Google and attempting to poach its employees for Otto.

According to Hoyos, the hacker was able to infiltrate database tables that contained information such as users, apps, and key types.

After repeating much of the same information included in the public statement, the email linked to a support page that users can only view after logging into their OneLogin account. In a follow-up, Hoyos added that this party did so by obtaining a set of AWS keys and used them to gain access to the AWS application programming interface via another service provider. Law enforcement and third-party security experts are now working with OneLogin to investigate the scope of the hack and identify the guilty parties involved.

OneLogin said in a blog post that it couldn't rule out the possibility that hackers got keys to reading encrypted data, such as stored passwords. "We want our customers to know that the trust they have placed in us is paramount", Hoyos wrote.

The company is suggesting customers take a number of actions to protect their accounts, from forcing a password reset and to generating new certificates for apps that use SAML SSO.

Password manager OneLogin suffered a breach in its US data region, according to a blog written by OneLogin CISO Alvaro Hoyos. It may be convenient to login once, since the service holds credentials to other cloud apps and sites, but why wouldn't an attacker be tempted to pull off one hack to get hold of so many credentials? Two-factor authentication is another trade-off - this time more security for less convenience.

Related News:

  • PPG throws in towel and abandons quest for AkzoNobel

    PPG throws in towel and abandons quest for AkzoNobel

    In April, Akzo put forward an alternative plan to the merger, promising to give shareholders 1.6bn euros in extra dividends. It said it still believed a combined company would "create more opportunities" for customers, employees and shareholders.
    Trump to announce decision on Paris climate pact Thursday

    Trump to announce decision on Paris climate pact Thursday

    President Donald Trump has declared that abandoning the Paris climate agreement would be a victory for the American economy. If the United States withdraws, it will join Syria and Nicaragua as the only countries not to participate in the agreement.
    Rogic's injury time victor  secures Scottish Cup, treble for Celtic

    Rogic's injury time victor secures Scottish Cup, treble for Celtic

    Celtic will need to improve their squad though if they are to compete in both domestic and European competitions. At the start of the season the gaffer has come in and changed the philosophy.
  • SEC tweaks graduate transfer rules, opening door for Zaire

    SEC tweaks graduate transfer rules, opening door for Zaire

    Friday's vote reduced the ban from three years to one, a proposal by the athletic directors at SEC spring meetings in Destin, Fla. Zaire hasn't made his final decision but reportedly was waiting to see what the SEC did before making his pick.

    Russia's ties with India will not be diluted: Putin

    Modi will be holding the 18th India-Russia annual bilateral summit with Russian President Vladimir Putin , on Thursday. Later, Putin will also host Modi at a private dinner in St Petersburg .
    Bryce Harper brawl-related suspension reduced to three games, reports say

    Bryce Harper brawl-related suspension reduced to three games, reports say

    Bryce Harper will serve a three-game suspension starting Wednesday night. Harper has been slumping over the last two weeks. He has also appealed the punishment.
  • 3 killed in shooting at Greenville Nissan dealership

    Police said that about 20 shots were fired in about six seconds, despite innocent employees as well as children being nearby. The shootout at Nissan of Greenville resulted in the deaths of Ramon Michael Hutchinson, Gabriel Bernal and Fidel Garcia.

    Palestinian hunger striking prisoners plan to observe Ramadan fasting

    But the Israeli prison spokesperson reportedly "declined to comment on whether any of the other demands were met". Barghouti's wife Fadwa hailed a "victory for resistance and dignity" after the end of the 41-day hunger strike .
    Teen Thanks Defenders After Being Protected From Portland White Supremacist

    Teen Thanks Defenders After Being Protected From Portland White Supremacist

    One of the young women who was targeted in the verbal assault by Christian thanked the two men who lost their lives helping her. The attack occurred on a light-rail train on the first day of Ramadan, the holiest time of the year for Muslims.
  • Trump Slams Kathy Griffin Decapitation Photo as 'Sick'

    Trump Slams Kathy Griffin Decapitation Photo as 'Sick'

    The US president castigated Kathy Griffin saying she "should be ashamed of herself" for the grisly-looking photograph. Meanwhile, a casino in New Mexico has scrapped a scheduled comedy performance by Griffin after her post.

    Trump to Keep Embassy in Tel Aviv — Sources to CNN

    Moving the embassy would likely indicate a change in U.S. policy toward recognizing Israel's claim to a united Jerusalem. Trump and Israeli Prime Minister Benjamin Netanyahu are fast friends.
    A Lorde fan has had a better day at work than you

    A Lorde fan has had a better day at work than you

    Lorde , real name Ella Yelich-O'Connor, is performing second to headliner Chance The Rapper at the Governors Ball on Friday. But *then* she shared a screenshot of a private conversation they had via Twitter after Lorde slid into her DMs.


Most liked

16-year-old girl charged with fatally stabbing Uber driver
Police say Eliza was unresponsive when they found her in hiding, blood splattered across her shirt and still gripping the weapons. Wasni climbed into the front seat of Nelson's silver sedan and drove away before striking a central reservation in the road.

Kurdish militants claim downing of Turkish military chopper
Defence minister Fikri Isik and other government ministers immediately left the capital, Ankara , for Sirnak, DHA reported. Turkish soldiers carry the coffin of Colonel Oguzhan Küçükdemirkol who was among 13 killed in the helicopter crash.

Finals pick up where they left off with Cavs-Warriors III
He's been mentioned on a level with Michael Jordan - I've chimed in on that subject - and for the most part it's deserved. As an underdog after finally bringing a banner home to Cleveland , James is playing with house money.

'Peace Is A Choice,' Trump Says During Appearance With Palestinian Leader
Trump also avoided any mention of a future Palestinian state in his brief remarks with Abbas after their meeting in Bethlehem . Former President Bill Clinton helped establish the current US policy on Jerusalem through the " Clinton Parameters " in 2000.

Next Weeks Broker Price Targets For Fitbit (NYSE:FIT)
Fitbit Inc. (FIT ) belongs to the "Technology" sector with an industry focus on "Scientific & Technical Instruments", with Mr. In other news, EVP Andy Missan sold 50,000 shares of the firm's stock in a transaction that occurred on Tuesday, March 7th.

Japan, US Conduct Joint Naval Drill Off Korean Peninsula
USA and Japanese leaders had agreed 26 May to increase tangible pressure on North Korea. Washington has described the exercise as " routine training ".

"March Against Sharia" Intended for Portland Is Headed for Seattle Instead
My heart goes out to the family of Rick Best. "We didn't want him with us", Joey Gibson , the rally's organizer, told CNN . During the arraignment yesterday, the accused shouted, you call it terrorism, I call it patriotism.

Comey to Testify to Senate Next Thursday
Mueller was chosen to lead the department's investigation on May 17 amid concern of political interference. The former NSA director had a remarkably short tenure.

Bombing in diplomatic area of Kabul kills 80, wounds scores
The United States now has more than 8,000 troops in Afghanistan, training local forces and conducting counterterrorism operations. Ismail Kawasi , spokesman for the public health ministry, said more than 50 wounded people are in Kabul hospitals so far.

Half of Donald Trump's Twitter followers are bots
He has forged a career out of social media and the internet and said he recognizes follower buying as common practice. According to archives, it has taken Trump since the beginning of March to gain a total of 5 million new followers.

Preds win from ousting Ducks to reach 1st Stanley Cup Final
In four games against the Predators, the 24-year-old winger had scored one goal and two assists. Rickard Rickell and Patrick Eaves did not make the trip to Nashville and will miss game six.

Greg Gianforte Apologizes for Body-Slamming Reporter; Wins Montana Election
The Gallatin County Sheriff's Office issued a misdemeanor assault citation to Gianforte, but did not arrest him. Gianforte had to silence his crowd of supporters to apologize .

Britain's Theresa May calls on British Airways to compensate customers for delays
The British flag carrier has said the problem was caused by a power supply issue at one of its United Kingdom data centers. The airline also admitted that it was aware some passengers were unable to file a delayed bag report on its website.

Young IAS official tries to rescue lady colleague, drowns in pool
Eyewitnesses claimed that a woman officer slipped and fell into the pool and many, including Dahiya, jump in to rescue her. The family of the deceased have been informed of the unfortunate death and they have reached Delhi.

Pune restrict Mumbai to 129/8 in IPL final
Rohit pulled a half-pitched ball to Thakur at deep mid-wicket, while Pollard offered an easy catch to pouch for Tiwary at long-on. Bumrah´s two strikes included the big wicket of former India captain Mahendra Singh Dhoni (10), playing in his seventh IPL final.