Every public data breach

Disclosed this week47On record26,367

47 disclosed this week · 26,367 on record

LastPass

Disclosed Nov 30, 20221,600,000 affectedSettled

Official notice

Attacker steals LastPass customer vault backups after earlier dev breach

LastPass said a threat actor used information stolen in an August 2022 breach of its development environment to access cloud storage and copy backups of customer account data and encrypted password vaults. It later described the events as two linked incidents, the second targeting a senior DevOps engineer.

What is known

People affected1,600,000 (as reported by the organization)
DisclosedNov 30, 2022
DiscoveredAug 2022
AttackHacking
Data exposedNamesEmailsPhone numbersAddressesIP addressesPasswordsCredentials and tokensSource code
SectorTech · US
StatusSettled
Lawsuit or fineGBP 1,228,283 ICO fine (Nov 2025) (about $1.6M)

Sources

The organizationblog.lastpass.com
03-01-2023: Security Incident Update and Recommended Actions
The organizationblog.lastpass.com
12-22-2022: Notice of Security Incident
Newstechcrunch.com
The badly handled data breaches of 2022
Regulatorico.org.uk
Password manager provider fined GBP 1.2m by ICO for data breach
Regulatorico.org.uk
ICO: LastPass UK Ltd
Newstechcrunch.com
LastPass says it was breached, again

Notices filed

TotalNov 30, 2022
Research1,600,000 people
TotalDec 22, 2022
ResearchCount not stated

Other breaches at LastPass

LastPass support case data stolen via Klue OAuth tokensSupply chain exposed names, phone numbers, emails, addresses and messages.Supply chainTechUSJun 23
History of this record
disclosed2026-09-25
2022-12-22 to 2022-11-30by admin
status2026-09-25
confirmed to settledby admin
records2026-09-25
empty to 1600000by admin
fine_usd2026-09-25
empty to 1620000by admin
discovered2026-09-25
empty to 2022-08by admin
lawsuit2026-09-25
empty to GBP 1,228,283 ICO fine (Nov 2025)by admin
Added2026-09-25
First recordedby seedSource

First seen 2026-09-25 (Research), confirmed by Research. Record counts are as reported. Not legal advice.

Everything about LastPass