Click Studios, maker of the enterprise password manager Passwordstate, notified its 29K customers about a supply chain attack deployed via an update of the app
The RecordCatalin Cimpanu
Context & Ripple Effects
Passwordstate’s incident turns its software-update mechanism into the relevant security boundary for 29,000 enterprise customers. Related coverage had already shown that a password-manager breach can expose account-related data even when a vendor says its secure vault was not accessed, in LastPass’s earlier breach disclosure.
Later LastPass reporting broadens the category’s attack surface beyond the password vault itself: attackers reached vault data through third-party software on an engineer’s computer in the 2022 LastPass intrusion. Passwordstate is an earlier example of the same trust problem appearing in the update channel.
First-order effects
Click Studios must shift from routine Passwordstate operations to incident communications with 29,000 customers whose deployed update path was compromised.
Passwordstate customers must treat an application update—a normally trusted administrative mechanism—as the immediate exposure point in this incident.
Second-order effects
Enterprise buyers evaluating Passwordstate and rival password managers gain reason to assess update-delivery and third-party access controls alongside vault protections, given LastPass’s third-party software compromise.
Password-manager vendors face a sharper trust burden: a breach in delivery infrastructure can affect every customer that accepts a vendor-issued update, not just a single exposed account.
Third-order effects
If incidents across password managers continue to originate outside the vault, competition will increasingly turn on the security of the surrounding software supply chain and support ecosystem, not encryption claims alone.
The category’s security boundary is moving from the password vault to the full chain of vendor updates, employee devices, cloud storage, and external service providers.
The trend: Password-management security is becoming an ecosystem-integrity problem, with trusted vendor and third-party channels becoming as consequential as the vault itself.
During an incident response case for one of our customers CSIS researchers discovered a supply chain attack against a rather popular corporate password manager called Passwordstate. Read more: https://www.csis.dk/... #cyberattack #SupplyChain #cybersecurity
New: Australian security software house Click Studios has warned users of its password manager Passwordstate to ‘reset all passwords’ after attackers planted a malicious update. Users were exposed over a 28-hour window between April 20-22. https://techcrunch.com/...
I know there might be some panic regarding “those supply chain breaches are getting more frequent”, but the reason we are seeing more of them just might well be “we are getting better at finding them” https://twitter.com/...
ClickStudios, which makes the enterprise password manager Passwordstate, has been hit by an apparent supply chain attack. ClickStudios claims 29,000 customers including in government, banking, and pretty much every industry vertical. https://www.csis.dk/... https://twitter.com/..…
I've been saying this for 20yr: “#Passwordstate #breach underscores the risk posed by password managers because they represent a single point of failure that can lead to the compromise of large numbers of online assets.” #cybersecurity https://arstechnica.com/...
Here's an analysis of the malware, via CSIS, which had to deal with this incident's aftermath: https://www.csis.dk/... -Here's a copy of the notification letter the company sent customers, via Niebezpiecznik: https://twitter.com/...
Breaking: Password manager Passwordstate hacked to deploy malware on customer systems -The app's update mechanism was compromised for 28h -Unclear what the malware did, but assume your passwords have been compromised and start changing everything https://therecord.media/... https…
ClickStudios has told customers a breach occurred that resulted in a supply chain attack via update of password manager PASSWORDSTATE. Breach occurred between Apr 20-22. The update dropped a malicious zip file “Passwordstate_upgrade.zip” w/ rogue .dll https://www.csis.dk/...