alt Hacker NewsNot GP, but I've seen this happen a few times with $work managed password managers. From memory and in no particular order, the reasons for the breach were:
- User account with access to the SaaS password manager was compromised.
- User account with access to the SaaS password manager was compromised.
- User account with access to the SaaS password manager was compromised.
- Password safe file (keepass) was compromised/leaked and its (medium-strength) master password was presumably brute-forced.
EDIT forgot one:
- Password manager was used by a user-facing web backend, which unlocked it with an unscoped read-everything master password. Web backend was hacked, predictable consequences ensued.
These examples are very different than your provider being hacked.
Ideally you should be isolating your passwords across the company so that one user doesn’t compromise every login, no?