Quick wins for a faster PC:
Clear out junk files and repair common Windows errorsFree Scan →Scan for outdated or missing drivers - takes under a minuteDriver Scan →iTechGuides is reader-supported. When you buy through links on our site, we may earn an affiliate commission. As an Amazon Associate I earn from qualifying purchases. Learn more
Yes. GoTo said an attacker stole encrypted backups for Central, Pro, join.me, Hamachi, and RemotelyAnywhere, along with an encryption key for part of those backups. The affected data could include usernames, salted and hashed passwords, MFA settings, product settings, and licensing information. GoTo did not report a blanket compromise of all its services.
What happened in the GoTo breach?
GoTo disclosed unusual activity on November 30, 2022, in a development environment and a third-party cloud-storage service shared by GoTo and its affiliate LastPass. On January 23, 2023, GoTo said its investigation had found that a threat actor exfiltrated encrypted backups from that storage service and an encryption key for a portion of the backups.
The fact that backups were encrypted matters, but it does not mean every copied item was inaccessible: GoTo said an encryption key for some of the backups was also taken. The disclosure does not establish that every backup was decrypted or that every listed type of information was present in every affected customer’s data.
Windows Errors? Fix Them Before They Spread
Repair common Windows errors and clear accumulated junk for a smoother, more stable PC - no reinstall needed.Free scan · no reinstallOutdated Drivers Are Slowing You Down
One free scan finds every outdated or missing driver and matches the right update for your exact hardware.Free scan · exact hardware matchOn April 20, 2023, GoTo said its investigation was complete, the attacker’s access had been eliminated, and it had found no evidence of additional compromise or activity beyond what it disclosed in January.
#1 Best Overall
- POWERFUL SECURITY KEY: The YubiKey 5 NFC is the most versatile physical passkey, protecting your digital life from phishing attacks. It ensures only you can access your accounts
- WORKS WITH 1000+ ACCOUNTS: Compatible with popular accounts like Google, Microsoft, and Apple. A single YubiKey 5 NFC secures 100+ of your favorite accounts, including email, password managers, and more
- FAST & CONVENIENT LOGIN: Plug in your YubiKey 5 NFC via USB and tap it, or tap it against your phone (NFC), to authenticate. No batteries, no internet connection, and no extra fees required
- MOST SECURE PASSKEY: Supports FIDO2/WebAuthn, FIDO U2F, Yubico OTP, OATH-TOTP/HOTP, Smart card (PIV), and OpenPGP. That means it’s versatile, working almost anywhere you need it
- PRIMARY & SPARE KEYS: Just like having a spare house key, we recommend buying two YubiKeys - one for daily use and one as a spare. That way you’ll never get locked out of your accounts
Which GoTo products were affected?
| Products | What GoTo said was affected |
|---|---|
| Central, Pro, join.me, Hamachi, RemotelyAnywhere | Encrypted backups were exfiltrated. The potentially included information could include account usernames, salted and hashed passwords, some MFA settings, product settings, and licensing information. |
| Rescue, GoToMyPC | The encrypted databases were not exfiltrated, but MFA settings for a small subset of customers were impacted. |
| GoTo Resolve, GoTo Connect, GoTo Meeting, GoTo Webinar, GoTo Contact Center, GoTo Assist, GoTo Training, Grasshopper | GoTo said these products had no impact from the incident. |
These distinctions are important: Rescue and GoToMyPC were not in the group whose encrypted backups GoTo said were stolen, while their limited reported impact concerned MFA settings.
Do you need to reset your GoTo password?
GoTo said it was contacting affected customers and resetting passwords for affected users. If you use one of the products tied to stolen backups, pay attention to direct communications from GoTo and follow any account-specific reset instructions. GoTo’s statement does not say that every customer across every product needed a reset.
Rank #2
- Security Key : Protect your online accounts against unauthorized access by using FIDO2 and U2F authentication with T120. It's the world's most protective security key that works with windows, Mac OS, Linux as well as Chrome, Firefox, Edge and many other major browsers.
- Certified with the new FIDO2 standard, T120 provides the benefit of fast login and strong protection against phishing, account takeover as well as many other online attactks.
- Works with : Bank of America, Github, Google, Microsoft, DUO, Twitter, Facebook, Dropbox, Apple, ebay, BINANCE, mor and more.
- Fits USB-C port : Insert the T120 security key into the USB-C port of each service and log in conveniently with one touch
- For the driver download and user guide, please visit TrustKey Solutions Home support page.
GoTo also said it would reauthorize MFA settings where applicable and migrate accounts to an enhanced Identity Management Platform with stronger authentication and login-security options. If GoTo asks you to reauthorize MFA, complete that process through the account flow GoTo provides; do not treat an unexpected message asking for credentials as proof that it is genuine.
Do these 3 things before closing this tab:
1Fix the driver behind crashes, sound loss and screen glitches2Repair Windows errors before they cause bigger problems3Scan for outdated or missing drivers - takes under a minuteWas your MFA compromised?
GoTo said some MFA settings could have been included in affected backups. It separately reported that MFA settings for a small subset of Rescue and GoToMyPC customers were impacted even though those products’ encrypted databases were not exfiltrated. The public description does not identify every affected account or specify that an attacker used MFA to enter customer accounts.
Rank #3
- ✅ PROTECT ONLINE ACCOUNTS – A password manager, two-factor security key, and secure communication token in one, OnlyKey can keep your accounts safe even if your computer or a website is compromised. OnlyKey is open source, verified, and trustworthy.
- ✅ UNIVERSALLY SUPPORTED – Works with all websites including Twitter, Facebook, GitHub, and Google. Onlykey supports multiple methods of two-factor authentication including FIDO2 / U2F, Yubico OTP, TOTP, Challenge-response.
- ✅ PORTABLE PROTECTION – Extremely durable, waterproof, and tamper resistant design allows you to take your OnlyKey with you everywhere.
- ✅ PIN PROTECTION – Locking your device means that if this device is stolen, data remains secure, after 10 failed attempts to unlock all data is securely erased.
- ✅ EASY LOG IN – No need to remember multiple passwords because by plugging OnlyKey to your computer, it automatically inputs your username and password. It works with Windows, Mac OS, Linux, or Chromebook, just press a button to login securely!
If GoTo contacts you to reauthorize MFA, set it up again as instructed. If you have not received a notice but are concerned, check your account through GoTo’s official sign-in route or contact GoTo support using contact details you obtain independently. Do not share a one-time code with someone who contacts you.
How does the related LastPass incident fit in?
GoTo and LastPass shared the third-party cloud-storage service involved in GoTo’s disclosure, but their reported impacts were not identical. LastPass said an attacker used information from an August 2022 development-environment incident to access a separate cloud-storage environment containing archived production backups.
Rank #4
- Ultra-Compact FIDO2 Security Key - Plug-and-stay or carry on a keychain. This USB-A hardware security key offers portable, always-on protection for desktop and mobile use. (Item Size: 0.75 X 0.74 IN x 0.25 IN)
- USB-A Hardware Key for All Devices - Works with USB-A ports on PC, Mac, Android, and other laptop/notebook device. Enables secure, cross-platform login with FIDO2.0 passkey support.
- FIDO Certified Security Key - Meets FIDO and FIDO2 standards. Works with Google, Microsoft, GitHub, Dropbox, and more. Please check service compatibility before purchase.
- Passwordless Login with Passkey - Supports passkey login via WebAuthn and CTAP2. Enjoy password-free sign-ins where supported. Not all websites or services currently support passkeys.
- Advanced Multi-Factor Authentication - Offers 200 FIDO2 passkey slots and 50 OATH-TOTP slots. Strong, flexible 2FA/MFA support across various apps and authentication platforms.
LastPass’s December 22, 2022 notice said the copied data included account metadata—such as company and end-user names, billing addresses, email addresses, telephone numbers, and IP addresses—as well as a customer-vault backup. LastPass said vaults used a proprietary binary format that included some unencrypted information, such as website URLs; sensitive fields were protected with 256-bit AES, with keys derived from each user’s master password.
In a March 1, 2023 update, LastPass said the later incident also reached cloud backups containing configuration data, API secrets, third-party integration secrets, customer metadata, and backups of all customer vault data. It identified a LastPass MFA/Federation database containing authenticator seeds, telephone numbers used for MFA backup when enabled, and a split-knowledge federation key. Although that database was encrypted, LastPass said its separately stored decryption key was among the secrets stolen in the second incident.
LastPass said in its December 2022 notice that it notified a small subset of Business customers—less than 3%—to take account-specific actions. That figure describes LastPass’s notification group, not the share of GoTo customers affected.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.What security changes did GoTo report?
Alongside customer password resets and MFA reauthorization, GoTo said it was migrating accounts to an enhanced Identity Management Platform, reviewing controls and configurations, and strengthening encryption in its applications and backup infrastructure. Those are the measures GoTo reported; the public updates summarized here do not provide account-by-account impact details.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
Free tools Windows power users keep installed
One-click scans. No signup required.
