LastPass Data Breach 2022: What Was Taken and What to Do

The vault contents were encrypted, but some details around them were not.

By Siddharth ShankarUpdated October 23, 2026

Password managers hold the keys to everything else, so an incident at one is worth understanding in detail. This guide follows LastPass’s own December 22, 2022 notice. The company says that page may not be its latest word, so check its current security-incident updates as well.

What happened

LastPass said an attacker gained access to its development environment in August 2022 and took source code and technical information. At that time it said no customer data or encrypted vaults were accessed. On November 30, 2022 it detected unusual activity in a third-party cloud storage service that it shares with an affiliate, GoTo. In its December 22 notice, LastPass said the attacker had used information from the August incident to get into that storage and copy backup data.

What was taken

The notice describes two groups of data.

• Basic account information: company names, end-user names, billing addresses, email addresses, telephone numbers and the IP addresses customers used to access the service.
• A backup copy of customer vault data: this included unencrypted fields such as website URLs. It also included fully encrypted fields such as website usernames and passwords, secure notes and form-filled data, protected with 256-bit AES encryption.

On payment cards, LastPass said it saw no evidence that unencrypted card data was accessed and that it does not store full card numbers.

Why the master password is the key

LastPass states that the master password is never known to it and is not stored or maintained by it. The encrypted fields can only be decrypted with a key derived from each user’s master password, and that happens only in the local LastPass client. That means the copied vaults cannot simply be opened by the attacker. The risk LastPass named is brute-force guessing of master passwords against the copied data. A long, unique master password makes that far harder than a short or reused one.

What else LastPass warned about

It also pointed to phishing, credential stuffing and brute-force attacks against online accounts that were linked to the vault. This is where unencrypted details matter. A list of the websites someone uses, together with their email address, can make a convincing fake message easier to write. See how to tell if a breach notice is real or phishing.

What LastPass recommended

LastPass said that customers using its default settings, which it described as a 12-character minimum master password and 100,100 PBKDF2 iterations, did not need to take action. For people who had set up a non-default master password, it suggested considering changing the passwords for the websites stored in the vault. It said Business customers using Federated Login needed no extra action, and that it contacted fewer than 3% of Business customers directly with account-specific steps.

It also said it would never call, email or text you to ask you to click a link to verify information, and that it will not ask for your master password except when you sign in to your vault from a LastPass client.

What to do if you use a password manager

1. Check your master password. Make it long and unique, and never use it anywhere else.
2. Change the most valuable passwords first. Email, banking and any account used to reset others come first.
3. Turn on two-factor authentication for your password manager and for key accounts.
4. Be cautious with messages that mention your password manager or a “security update”. Go to the official site by typing the address yourself.
5. Look for signs of misuse. Read our list of account takeover warning signs.

Does this mean password managers are unsafe?

No single incident answers that, and this guide does not claim a view either way. What the notice shows is that encryption protects the contents only as well as the master password protects the key, and that unencrypted metadata can still be useful to criminals. A manager still helps you avoid reusing passwords, which is behind many attacks. Read credential stuffing explained to see why.

If your passwords may have leaked

Use a breach-checking tool to see whether specific passwords have appeared in known leaks. Our guide on checking a leaked password explains how, and should you worry about an old breach helps you decide how urgent it is.