LastPass says the attacker behind the August security breach had internal access to the company's systems for four days until they were detected and evicted.