LastPass disclosed two related intrusions in 2022. In the first, an attacker entered parts of the company’s development environment and exfiltrated source-code repositories, technical documentation, and an encrypted copy of the key protecting customer backups in Amazon S3. In the second, a senior DevOps engineer’s personal computer was compromised with a keystroke logger. The stolen credentials opened an internal vault containing further keys, enabling access to a backup database and copies of some customer vaults. Exposed data included names, email and billing addresses, partial payment-card information, and website URLs; usernames and passwords were stored in encrypted fields.
The breach created a lasting risk because attackers could subject stolen vaults to offline cracking attempts, with older vaults and weak or previously exposed master passwords more vulnerable. KrebsOnSecurity reported in September 2023 that researchers had linked decrypted vaults to more than 150 victims and over $35 million in losses, particularly involving cryptocurrency seed phrases; a later $150 million heist was also linked to the theft. The UK Information Commissioner’s Office found that more than one million UK data subjects were affected and, on November 20, 2025, fined LastPass UK Ltd £1,228,283 for inadequate technical and organizational safeguards, including linking personal and business accounts under one master password and allowing senior employees to use business accounts on personal devices. A related class action settlement reported in February 2026 totaled $24.5 million, including $16 million designated for cryptocurrency-related losses.
