A password manager keeps every login a person has inside one encrypted vault: usernames, passwords, security notes, card numbers. That vault is locked behind a single master password only the user knows, and the software fills in each login automatically. A person can keep a strong, different password for every account without remembering any of them. The company that makes the password manager never keeps a copy of the master password. If a user forgets it, the company cannot recover it, because it never held it. Even someone who breaks into the company’s own servers cannot read the vaults, because the key that decrypts them exists only in the user’s head.
By 2022, LastPass had built that promise into a business serving more than a hundred thousand companies and tens of millions of individual users. People trusted it with the credentials to their bank accounts, their email, their medical portals, their cryptocurrency wallets, in many cases the keys to every account they owned. For companies, it held the logins employees used to reach internal systems, customer databases, and financial platforms.
The breach began with two separate intrusions, aimed at two different employees, a day apart. On August 11, 2022, a software engineer’s corporate laptop was compromised, and from it the attacker moved into LastPass’s cloud-based development environment, staying inside for four days before the security team noticed and shut it down. What the attacker took was source code and internal technical documentation, not customer data, encryption keys, or vault contents. LastPass disclosed the incident publicly on August 25, describing it as contained.
Source code and internal documentation are not the same kind of thing. Source code lets you study how software works and look for weaknesses, but it does not hand you the running service. The documentation is different. It describes the architecture: where production systems sit, how they connect, which keys and credentials give access to which services, and where the backups are kept. For LastPass, that documentation mapped the route from an employee’s credentials all the way to the cloud storage holding customer data. Now the attacker had the floor plan.
The next target was the senior DevOps engineer with access to the company’s most sensitive infrastructure: the cloud storage where customer vault backups were kept, and the keys that decrypted them. Those credentials sat inside the engineer’s own LastPass vault, behind a master password, so the attack moved to the engineer’s home computer. On that machine was a copy of Plex Media Server, ordinary consumer software people run at home to organize and stream their own movie and music collections. It carried a known flaw, catalogued as CVE-2020-5741, that let an attacker who already had administrative access to the server run code of their own choosing on the machine underneath it, including capturing keystrokes without the user seeing any sign of it. Plex had published a fix in May 2020. More than twenty-six months passed between that fix becoming available and the attacker walking through the door it had been meant to close. Once inside, the attacker installed a keylogger, which recorded what the engineer typed and sent it back. Among the keystrokes it captured was the engineer’s LastPass master password.
Under normal conditions, one person’s master password opens only that person’s vault. LastPass allowed its employees to link their personal password vault to their corporate “Employee Business” vault, and once linked, both shared a single master password. One password, typed once, opened both: the employee’s private logins and their workplace access, including tokens for critical internal systems. For this engineer, the workplace side included the decryption keys for the entire customer vault backup, all of it reachable from a home computer with no corporate device management, no corporate firewall, and no corporate monitoring around it. The UK’s National Cyber Security Centre had warned specifically against this kind of arrangement years earlier, in guidance published in 2019 and again in 2021; the UK’s Information Commissioner’s Office later found that LastPass’s vault-linking policy contradicted both.
Inside the business vault, the attacker found an AWS access key and the decryption key for the backup storage, held in Amazon’s cloud under a method that encrypts data with a key the customer, not Amazon, controls. One key got the attacker into the storage; the other decrypted what was inside. There was still one barrier: the engineer’s account was protected by multi-factor authentication. But many MFA systems, once a device has passed the check, hand it a small piece of data, a trusted-device cookie, that tells the system this device has already cleared the second step. The attacker copied that cookie off the home computer and used it to sign in as the engineer without being asked for the second factor again.
The copying of data out of the backups began in the second half of August 2022, one week after the keylogger was planted, and continued for more than a month, ending September 22. Throughout, the attacker connected through third-party VPN services that disguised the true source of the connections, and the slow, steady pace of the copying looked more like ordinary work than a single large theft. The first automated alert, from Amazon’s GuardDuty threat-detection service, came October 15, more than three weeks after the copying had ended. Because of an ongoing corporate transition, that alert did not reach LastPass’s security team until November 2, when the investigation that confirmed the theft began. LastPass disclosed the second incident publicly on November 30, 2022, roughly three and a half months after the intrusion began.
The backup database held vault data for the entire user base: more than thirty-three million individuals and over a hundred thousand businesses. Some of it was readable immediately: company names, account holder names, billing addresses, email addresses, phone numbers, login IP addresses, and the web addresses saved inside each vault. That alone let an attacker sort the haul and decide which vaults were worth attacking first. The contents that mattered most, the actual usernames, passwords, and authenticator seeds, stayed encrypted behind each user’s own master password, run through a key-derivation function that deliberately slows down every guess. LastPass had set its default at just over a hundred thousand rounds; the benchmark recommended at the time by OWASP, the widely followed application-security body, was roughly three hundred and ten thousand, rising to six hundred thousand in early 2023. For anyone who had chosen a long, random, unique master password, the vault would likely hold up even at the lower setting. For anyone who had reused a password or chosen a short one, the lower round count meant each guess came faster, and across thirty-three million people, a good number surely had.
TRM Labs, a blockchain-intelligence firm, later traced cryptocurrency movements that followed the breach. By its analysis, more than thirty-five million dollars in Bitcoin and other digital assets was taken from victims whose cracked vaults gave up wallet keys and recovery phrases, laundered through exchanges TRM identified, including Cryptex, which the US Treasury’s Office of Foreign Assets Control sanctioned in 2024. From the patterns in how the funds moved, TRM assessed the activity as consistent with Russian cybercriminal actors. That is TRM’s assessment; LastPass itself has attributed the attack only to an unknown threat actor, and no government has issued a formal attribution.
The theft went beyond cryptocurrency. In the consolidated US class-action litigation, plaintiffs documented attempted unauthorized card charges, unauthorized loan applications, and direct theft from financial accounts, all traced to credentials stored in the compromised vaults. LastPass has since agreed to settle those consolidated claims for about twenty-four and a half million dollars; a settlement is not an admission of liability. In the UK, the Information Commissioner’s Office imposed a penalty of just over 1.2 million pounds under UK data-protection law, citing failures in the controls over privileged access from personal devices.
LastPass’s response reversed nearly every condition that had made the breach possible. It rotated the relevant shared secrets and certificates, decommissioned the development environment the first intrusion had mapped, and rebuilt it from scratch. It moved to a zero-trust architecture, in which no device or user is trusted automatically. Every employee received a company-managed phone and laptop, ending the practice of reaching corporate systems from personal devices. Hardware security keys from Yubico, which cannot be phished or lifted by copying a file, replaced the old MFA setup. Personal and corporate vaults could no longer be linked, and the default PBKDF2 count was raised to six hundred thousand rounds, matching OWASP’s updated guidance.
LastPass encrypted thirty-three million vaults to a standard an attacker on its own servers could not break, and then let the key to all of them sit reachable from a home computer running movie software with a flaw that had been patchable for more than two years. The perimeter was not where the org chart said it was. It was wherever those employees happened to be sitting.
**Sources & further reading:**
- LastPass, “Notice of Recent Security Incident” (August 25, 2022)
- LastPass, “Notice of Recent Security Incident” (November 30, 2022)
- LastPass, “Notice of Recent Security Incident & Recommended Actions” (December 22, 2022)
- LastPass, “Security Incident Update and Recommended Actions” (March 1, 2023)
- NVD / CISA KEV, CVE-2020-5741 (Plex Media Server)
- UK Information Commissioner’s Office, enforcement action against GoSecure Inc. t/a LastPass (November 20, 2025)
- TRM Labs, blockchain trace report on cryptocurrency stolen following the LastPass breach
- OWASP Password Storage Cheat Sheet, PBKDF2 iteration recommendations
- Consolidated US class-action docket, In re LastPass Data Security Incident Litigation (D. Mass.)