LastPass
Disclosed Nov 30, 20223 years ago1,600,000 affectedSettled
Attacker steals LastPass customer vault backups after earlier dev breach
LastPass said a threat actor used information stolen in an August 2022 breach of its development environment to access cloud storage and copy backups of customer account data and encrypted password vaults. It later described the events as two linked incidents, the second targeting a senior DevOps engineer.
What is known
| People affected | 1,600,000 (as reported by the organization) |
|---|---|
| Disclosed | Nov 30, 2022 |
| Discovered | Aug 2022 |
| Attack | Hacking |
| Data exposed | Names, Emails, Phone numbers, Addresses, IP addresses, Passwords, Credentials and tokens, Source code |
| Sector | Tech · US |
| Status | Settled |
| Lawsuit or fine | GBP 1,228,283 ICO fine (Nov 2025) (about $1.6M) |
Sources
| Source | |
|---|---|
| 03-01-2023: Security Incident Update and Recommended Actionsblog.lastpass.com · The organization | The organization |
| 12-22-2022: Notice of Security Incidentblog.lastpass.com · The organization | The organization |
| The badly handled data breaches of 2022techcrunch.com · News | News |
| Password manager provider fined GBP 1.2m by ICO for data breachico.org.uk · Regulator | Regulator |
| ICO: LastPass UK Ltdico.org.uk · Regulator | Regulator |
| LastPass says it was breached, againtechcrunch.com · News | News |
Notices filed
Other breaches at LastPass
| Breach | Affected | ||||
|---|---|---|---|---|---|
| LastPass support case data stolen via Klue OAuth tokensJun 233 months agoSupply chain | Jun 233 months ago | Supply chain | Tech | Confirmed | Unknown |
History of this record
- 2026-09-25 · disclosed: 2022-12-22 to 2022-11-30 · admin
- 2026-09-25 · status: confirmed to settled · admin
- 2026-09-25 · records: empty to 1600000 · admin
- 2026-09-25 · fine_usd: empty to 1620000 · admin
- 2026-09-25 · discovered: empty to 2022-08 · admin
- 2026-09-25 · lawsuit: empty to GBP 1,228,283 ICO fine (Nov 2025) · admin
- 2026-09-25 · added · seed source
First seen 2026-09-25 (Research), confirmed by Research. Record counts are as reported. Not legal advice.