OneLogin Inc., the provider of a single-sign-on password management service, announced today that it has suffered a data breach that may have put user information at risk.

While OneLogin admitted the breach today, the company did not reveal to what extent its systems had been compromised.

“Today we detected unauthorized access to OneLogin data in our US data region,” Alvaro Hoyos, chief information security officer at OneLogin, said in a statement. “We have since blocked this unauthorized access, reported the matter to law enforcement, and are working with an independent security firm to determine how the unauthorized access happened and verify the extent of the impact of this incident. We want our customers to know that the trust they have placed in us is paramount.”

Hoyos said that OneLogin has already reached out to affected users to alert them of the breach and offer advice on what steps they should take to protect their passwords. Some of these steps include generating new desktop single-sign-on tokens for users, forcing password resets and generating new application programming interface keys. Hoyos also said that the company is “actively working to determine how best to prevent such an incident from occurring in the future.”

OneLogin encrypts its users’ password information, but according to a support page that is reportedly accessible to OneLogin account holders, the attackers may have gained access to “the ability to decrypt encrypted data.”

If true, this could shake consumer confidence in password management systems, since encryption is supposed to be their last unbreachable line of defense. On its website, OneLogin says that its service is used by more than 2,000 enterprise customers, including major companies such as Pinterest, Pandora and Conde Nast.

This is the second breach OneLogin has suffered in the last year. In August, the company alerted users that one of its standalone systems had been breached by an unauthorized user. Thanks to a bug, some of the information on the system was stored in plain text.

OneLogin boasts that its service allows employees to set and reset their own passwords without having to go through the information technology department, which sounds like an attractive option for companies looking to reduce their IT workload. But depending on the extent of OneLogin’s breach, some enterprise companies might have to rethink trusting their confidential info to third-party cloud services.

Photo: Visual Content Data Security via photopin (license)