Skip to content

LastPass

Disclosed Nov 30, 20223 years ago1,600,000 affectedSettled

Official notice

Attacker steals LastPass customer vault backups after earlier dev breach

LastPass said a threat actor used information stolen in an August 2022 breach of its development environment to access cloud storage and copy backups of customer account data and encrypted password vaults. It later described the events as two linked incidents, the second targeting a senior DevOps engineer.

What is known

People affected1,600,000 (as reported by the organization)
DisclosedNov 30, 2022
DiscoveredAug 2022
AttackHacking
Data exposedNames, Emails, Phone numbers, Addresses, IP addresses, Passwords, Credentials and tokens, Source code
SectorTech · US
StatusSettled
Lawsuit or fineGBP 1,228,283 ICO fine (Nov 2025) (about $1.6M)

Sources

Source
03-01-2023: Security Incident Update and Recommended Actionsblog.lastpass.com · The organization
12-22-2022: Notice of Security Incidentblog.lastpass.com · The organization
The badly handled data breaches of 2022techcrunch.com · News
Password manager provider fined GBP 1.2m by ICO for data breachico.org.uk · Regulator
ICO: LastPass UK Ltdico.org.uk · Regulator
LastPass says it was breached, againtechcrunch.com · News

Notices filed

WhereFiledPeople
ResearchtotalNov 30, 20221,600,000
ResearchtotalDec 22, 2022

Other breaches at LastPass

BreachAffected
LastPass support case data stolen via Klue OAuth tokensJun 233 months agoSupply chainUnknown
History of this record
  • 2026-09-25 · disclosed: 2022-12-22 to 2022-11-30 · admin
  • 2026-09-25 · status: confirmed to settled · admin
  • 2026-09-25 · records: empty to 1600000 · admin
  • 2026-09-25 · fine_usd: empty to 1620000 · admin
  • 2026-09-25 · discovered: empty to 2022-08 · admin
  • 2026-09-25 · lawsuit: empty to GBP 1,228,283 ICO fine (Nov 2025) · admin
  • 2026-09-25 · added · seed source

First seen 2026-09-25 (Research), confirmed by Research. Record counts are as reported. Not legal advice.

Everything about LastPass

New breaches by email

Wednesdays, only in weeks with newly disclosed breaches, the largest first.

Double opt-in. Unsubscribe any time.