Two related security incidents were disclosed by the password manager LastPass in 2022. In the first incident, an attacker accessed parts of LastPass's development environment and exfiltrated source code repositories and technical documentation, including an encrypted copy of the key used to protect backups of customer data stored in Amazon S3.
In a second incident, a senior DevOps engineer's personal computer was compromised, and the attacker used a keystroke logger to obtain the employee's credentials and access an internal vault holding further keys. According to the UK Information Commissioner's Office (ICO), this enabled access to and exfiltration of a backup database and copies of some customers' password vault data, which included both unencrypted fields (such as some website URLs) and encrypted fields (such as usernames and passwords).
The breach prompted litigation and regulatory scrutiny, including a monetary penalty issued by the ICO in November 2025 against LastPass UK Ltd for failures to implement appropriate technical and organisational measures affecting over one million UK data subjects. The breach led to further incidents because stolen vault backups can be subjected to offline cracking attempts: in 2025 LastPass settled a class action lawsuit in the amount of $24.5 million for losses incurred by customers whose vaults had been accessed.
LastPass stores users' credentials in encrypted "vaults". At the time of the incidents, LastPass operated its production environment in physical data centres and used Amazon S3 "buckets" for backup storage; it secured those backups using server-side encryption with a SSE-C key. The SSE-C key was always encrypted when not in use, and only four people at LastPass were able to decrypt the key itself.: 15
During the relevant period, LastPass permitted employees to link "Personal" and "Employee Business" LastPass accounts under a single master password.: 15
The stolen information included: unencrypted names, email addresses, billing addresses, partial credit cards and website URLs.: 27 It also included the password vaults that were encrypted with users' master passwords.: 14 The Information Commissioner's Office found that over one million UK data subjects were affected.: 27
The security of each user's encrypted password vault depends on the strength of the user's master password (or whether the password had previously been leaked), and the number of rounds of encryption used. Some customer vaults were more vulnerable to decryption than others because they were older, and LastPass had increased the minimum amount of encryption rounds over time.
In September 2023, Krebs On Security reported some stolen LastPass vaults were being successfully decrypted in offline attacks; researchers had linked thefts affecting more than 150 victims (totalling more than $35 million) and described a common factor among victims as having stored cryptocurrency "seed phrases" in LastPass. LastPass declined to answer questions about the research, citing an ongoing law-enforcement investigation and pending litigation. In 2025, a larger heist of $150 million was also linked to the 2022 data theft.
On 20 November 2025, the Information Commissioner's Office (ICO) issued a penalty notice to LastPass UK Ltd under section 155 of the Data Protection Act 2018, requiring it to pay £1,228,283 for infringements of Article 5(1)(f) and Article 32(1) of the UK GDPR. The ICO concluded that, during the period 31 December 2021 to 31 December 2024, LastPass hadn't implemented expected technical and organisational measures, including by allowing senior employees to use "Employee Business" accounts from personal devices and by permitting "Personal" and "Employee Business" accounts to be linked under a single master password; it found that these failings contributed to the unlawful access and exfiltration of personal data relating to approximately over a million UK-based customers. In announcing the enforcement action, Information Commissioner John Edwards said that "LastPass customers had a right to expect the personal information they entrusted to the company would be kept safe and secure". The fine had been reduced by 30% to reflect the measures that LastPass had in place at the time and put into place afterwards.: 79
A class-action lawsuit was initiated in early 2023, with the anonymous plaintiff stating that LastPass failed to keep users' information safe. Of particular concern in the lawsuit was the increased risk of the details being used in phishing attacks. In November 2025 the parties informed the court that they had reached an agreement in principle, and it was reported in February 2026 that the settlement was in the amount of $24.5 million, with $16 million of that set aside specifically for loses related to cryptocurrency.