MyRecon OSINT

← Case Files · The Breach Files

2022 · Password manager

LastPass, 2022: the vaults were stolen, and then attacked offline

Case file · 4 min read · Published 14 September 2026

People affected
backups of customer vaults, affecting tens of millions of accounts
When it happened
August and November 2022
Made public
August 2022; full scope disclosed December 2022
How they got in
A compromised developer account, then a vulnerability in third-party software on a senior engineer's home computer
Attributed to
Unidentified; researchers have linked cracked vaults to a series of cryptocurrency thefts
What it cost
Reputational collapse in the security community; substantial downstream theft from users

What was exposed: Encrypted password vaults · Website URLs stored in vaults (unencrypted) · Names · Billing addresses · Email addresses · Phone numbers · IP addresses

A password manager is a concentration of risk accepted deliberately: you put everything in one vault because one strong secret protected properly beats a hundred weak ones scattered about. LastPass is the case that shows what happens when that vault leaves the building — and why the encryption holding is not the same as being safe.

Two incidents, one chain

August 2022. An attacker compromised a developer's account and took source code and technical documentation from a development environment. LastPass said at the time that customer data and vaults were not affected, which was true of that incident.

November 2022. Using what they had learned in August, the attackers identified a senior DevOps engineer — one of a small number of people with access to the decryption keys for cloud storage backups. They then exploited a vulnerability in a third-party media software package running on that engineer's personal home computer, installed a keylogger, and captured the engineer's master password as it was typed, after multi-factor authentication had already been satisfied.

That gave them the engineer's corporate vault. In it were the keys to the cloud storage holding customer vault backups, which they copied.

The perimeter question this raises. The intrusion that mattered did not happen on a corporate network, a company laptop, or any system LastPass monitored. It happened on a home media server belonging to an employee. For a small number of people in any organisation — the ones who hold keys rather than data — the blast radius of their personal computing is the entire company, and almost no security programme is scoped that way.

Why a stolen vault is worse than it sounds

The vault contents were encrypted with AES-256, using a key derived from each user's master password. That scheme was not broken, and LastPass was right to say so. It is also not the end of the analysis.

An online attack against a password manager is heavily constrained: rate limits, lockouts, alerting, and a second factor. An offline attack against a stolen vault file has none of those. The attacker can guess for years on hardware of their choosing, and nobody knows it is happening. Three things then determine whether a given vault falls:

  1. The master password's strength. A long, random passphrase is out of reach. A reused or dictionary-derived password is not.
  2. The key-derivation iteration count. Higher counts make each guess more expensive. Accounts created years earlier were running far lower counts than the then-current default, and some legacy accounts were dramatically lower — those vaults are far cheaper to attack.
  3. Time. Which is entirely on the attacker's side, because the file does not expire.

And the unencrypted metadata did real work independent of cracking. Knowing that a specific named person, at a specific address, holds accounts at particular cryptocurrency exchanges lets an attacker decide which vaults are worth spending compute on.

The downstream thefts

From 2023 onwards, independent researchers tracking cryptocurrency theft identified a recurring pattern: victims who lost funds from self-custodied wallets had stored seed phrases or exchange credentials in LastPass. The totals attributed to this cluster have run well into the hundreds of millions of dollars, and US forfeiture filings have referenced a 2022 password manager compromise in related proceedings.

The timing is the instructive part. Thefts continued long after the breach, because cracking a vault takes as long as it takes, and a seed phrase written into a vault in 2019 is still valid whenever the vault finally opens.

The disclosure problem

LastPass's communications drew as much criticism as the breach. The August notice said customer data was not affected. A November update said an incident had occurred using information from August. The December update — published just before the holidays — revealed that customer vault backups had been copied. The detail about the engineer's home computer came later still.

Each statement was defensible at the moment it was written. The cumulative effect was that customers learned the severity in stages over four months, which is precisely the pattern that destroys trust: not one lie, but a sequence of technically accurate statements that each turned out to be the floor rather than the ceiling.

What it changed

Iteration counts became a visible setting. Password managers raised defaults sharply and began prompting users to upgrade old accounts. A parameter that had been an implementation detail became something users were told to check.

Privileged personal devices entered threat models. Organisations with a handful of key holders started treating those individuals differently — hardware tokens, dedicated managed devices for privileged work, and separation between administrative access and personal computing.

"Encrypted" stopped being an acceptable one-word answer. The right questions are now: encrypted with what, derived how, how many iterations, and what metadata sits outside the encryption.

If you were a LastPass user

  1. Assume your vault as of late 2022 is in someone's possession. That is the only safe assumption, and it does not change with time.
  2. Rotate anything irreplaceable first. Cryptocurrency seed phrases and recovery codes cannot be un-stolen once cracked — move the funds rather than changing a password.
  3. Then rotate by value: email, banking, anything holding payment details. Yes, it is a long weekend of work. It is also the only real remediation.
  4. Keep using a manager — with a long master passphrase and maximum iterations. The lesson of this case is not that vaults are bad; it is that the parameters matter more than anyone told you — how to choose one you can actually remember.

Checked against every breach on record, against public breach data only. Your address is not sent to us as a form and is not stored — it is handed straight to the lookup tool in your own browser. See the privacy policy.

Questions people ask

Were LastPass passwords decrypted?

Not by breaking the encryption. Vault contents were protected with AES-256 derived from each user's master password, and that scheme was not defeated. The risk is offline brute force: an attacker holding the vault file can guess master passwords indefinitely, at whatever speed their hardware allows, with no lockout and no alerting. Weak master passwords, and old accounts with low key-derivation iteration counts, are the ones that fall.

What was not encrypted?

Metadata, including the website addresses stored in each vault, plus names, billing addresses, email addresses, phone numbers and IP addresses. Even without cracking anything, that tells an attacker which services a named person holds accounts with — including which cryptocurrency exchanges.

How did they get in through someone's home computer?

The attackers used information from the earlier August incident to identify a senior DevOps engineer, then exploited a vulnerability in a third-party media software package running on that engineer's personal home computer. That gave them a keylogger, which captured the engineer's master password after multi-factor authentication, which opened a corporate vault holding the keys to cloud backups.

Should I still use a password manager?

Yes. The alternative — reused passwords, or a notebook — fails far more often and far more quietly. What this case changes is the standard: a long, unique master password, the highest available key-derivation iteration count, two-factor authentication, and a willingness to rotate critical credentials if your provider is ever breached.

Sources

Read next

Case files are written from the public record: regulatory findings, court filings, company disclosures and contemporaneous reporting, cited above. Figures are the ones the organisation or its regulator finally settled on, which is often not the number first reported — where that differs, the page says so. Disputed accounts are marked as disputed rather than resolved in either direction.

← All case files Breach archive →