LastPass lastpass.com LastPass data breach: what happened and what to do
In 2022 an attacker stole LastPass source code, then a backup of customer account data and copies of password vaults. Vault contents stayed encrypted, but the encryption depends on each user's master password.
View all 13,177 breaches- Breach date
- Aug 2022
- Made public
- 25 Aug 2022
- Data exposed
- Names, Email addresses, Phone numbers, IP addresses
- Last updated
Reviewed by Anthon Wansland
Head of Product & Co-Founder
Serus is a privacy company with paid tools to find and remove your personal data. This page is free and based on official sources.
What happened
LastPass disclosed the first incident in August 2022: an attacker got into a development environment and took parts of its source code and technical information. At that point the company said it had seen no sign of customer data being affected.
In its December 22, 2022 update, LastPass said the attacker had used that access to copy a backup containing basic customer account information and related metadata. The attacker also obtained a backup of customer vault data.
Sources checked: blog.lastpass.com, identitytheft.gov
Last verified against the official page:
What was exposed
Per LastPass's notice, vault fields such as usernames and passwords are protected with 256-bit AES encryption and can only be decrypted with a key derived from your master password. Some data, such as website URLs, was not encrypted. Account information included names, email addresses, phone numbers and the IP addresses people used to reach LastPass.
The risk is mostly about your master password. If it was short or easy to guess, an attacker holding a copy of the vault can try guesses offline, with no lockout. A strong, unique master password makes that far harder.
What LastPass said to do
LastPass warned that the attacker might target customers with phishing, credential stuffing or brute force attacks on accounts tied to their vault. Contact details also make phishing emails that mention LastPass more convincing.
The company's notices are the primary record. They stayed up on the LastPass blog, and later updates may add detail.
What to do if you were in it
- 1
Change your master password
Pick a long, unique one that you use nowhere else. LastPass's guidance warns of attacks against vaults, and a strong master password is what protects a stolen copy.
- 2
Change passwords for important accounts
Start with email, banking and anything that holds money. Change a password on any site where you reused it, and turn on two-factor authentication.
- 3
Be careful with messages that mention LastPass
Phishing that quotes the breach is a known follow-on risk. Don't click links in unexpected emails or texts; go to the site yourself.
- 4
Use an authenticator app or security key where you can
The FTC advises turning on multi-factor authentication for accounts that offer it.
- 5
Check whether your email or phone is in this and other breaches
Run a free Serus scan to see which breaches include your email and phone number.
Timeline
-
The breach happened
-
The company made it public
Frequently asked
Were LastPass passwords stolen in the breach?
LastPass said vault data was copied but remains encrypted with a key derived from your master password. It was not stored in readable form.
What was exposed in the LastPass breach?
Source code in August 2022, then account information, metadata and backups of vault data. Some fields such as website URLs were not encrypted.
Should I change my passwords?
Change your master password if it was weak or reused. Changing passwords for important accounts is a sensible precaution.
Does LastPass still store my vault?
LastPass is a password manager, so your encrypted vault stays with the service while you use it. The 2022 incident involved copies of backups, which is why a strong master password matters.
Sources
Something wrong or out of date? Tell us and we'll re-check it.
