All items in my vault changed their last date and time to exact time/date. Have I been hacked?

jdoymail

I've used 1Password for years as a single user. I just went in to clean up some old entries and and noticed every item not used in the last few days shows "last used: Feb 16, 2021. What could cause this? Any recommendations?

---

1Password Version: 1Password 7 Version 7.7 (70700016) Mac App Store
Extension Version: Chrome 4.7.5.90
OS Version: MacOS Big Sur 11.2.1
Sync Type: Not Provided
Referrer: forum-search:I just discovered my vault has same last used date on all entries and I didn't do it. Have I been hacked?

ag_ana

Hi @jdoymail! Welcome to the forum!

I am not sure what could cause the last used date to be updated, other than actually using the item. However, that does not mean that you have been hacked: if you have not received any new login emails from these websites, or you have noticed no suspicious activity in your accounts, it is more likely that something happened inside 1Password that made it update this information.

Do you remember something special that happened on February 16th while you were using 1Password? Certain actions that you normally don't perform (such as applying tags to an item, for example, or moving items from one vault to another)?

jdoymail

No, I don't recall doing anything unusual. What I was doing yesterday was trashing some duplicate items that I believe were created a few years ago when I was notified of a change to the vault structure. I did go into a large number of items once I noticed the unusual last used dates. I just checked a few rarely use items and all (except those that I intentionally edited yesterday) now show a "last used" date and time of: Yesterday at 10:35 AM.

ag_ana

@jdoymail:

I did go into a large number of items once I noticed the unusual last used dates.

I think this might be it. Can you confirm what you mean by "go into" these items?

jdoymail

I just selected these items but didn't press edit. Right now nearly all (but not all) that have not been edited show a "last used" of February 19, 2021 at 10:35 AM. Even if I did edit all of them, I couldn't have done them all at 10:35 AM.

ag_ana

@jdoymail:

Editing an item would update a different field though, the last modified field, not the last used one. See an example from my own vault:

jdoymail

I'm confused. Could you give me a detailed explanation of what "last used" means in 1Password and precisely what time is recorded? It doesn't seem possible to "use" hundreds of items during the exact same minute.

ag_ana

@jdoymail:

Absolutely, I have sent your question to the team for details. We will post back as soon as we have an update :+1:

ag_ana

@jdoymail:

As promised, here I am with an update. I have heard back from the team, and this is a list of actions that cause the "last used" date to be updated:

1. Using Go & Fill
2. Entering item edit mode
3. Printing
4. Exporting
5. Sharing (via Traditional Share URL, Copy, or Move)
6. Copying a concealed field to the clipboard
7. Revealing (including Large Type and temporary shortcuts like holding down option key while item is displayed on 1Password for Mac)

I was told that the Print one could be particularly interesting in this case: when you choose to print a single item, the result is as though all items have been used, since you can choose to print all items in the print dialog, even if you originally selected only one.

williakz

@ag_ana, nice digging. Info saved to disk.

jdoymail

Very interesting. I can't say for sure if I printed anything at that point in time, but it's possible that I did. Thanks to you and your team for doing the research!

ag_ana

You are welcome! I am glad I could help :)