Norton LifeLock says thousands of customer accounts breached

It sounds they’re not using a service like HIBP to monitor compromised passwords and that they don’t have good controls for logins from unusual locations, both of which are table stakes for a service like this.

The note about MFA being optional as well is concerning since that’s similarly a sign that they’re years behind even the banking industry, as an ostensible security vendor selling a password manager.

The most concerning part is that they “cannot rule out that the intruders also accessed customers’ saved passwords” — since the attacker didn’t breach their application, this suggests that they don’t have adequate logging. Every access to a saved password should be logged.

LifeLock was always a scam, not a security company, and they had a history of security problems. Norton acquired them but as a subsidiary I’d expect less chulture change, especially given Norton’s own history here.