LastPass UK
Disclosed Nov 20, 202510 months agoSettled
UK ICO fine for security failings
£1,228,283 penalty issued to password management provider LastPass UK Ltd on 20 November 2025 in respect of infringements of Article 5(1)(f) and Article 32(1)(f) UK GDPR. LastPass' failure to implement appropriate technical and organisational security measures allowed a threat actor to exfiltrate personal data relating to approximately 1.6 million UK customers from its backup database. However, due to LastPass' "zero knowledge" encryption system, the most sensitive personal data stored in LastPass customers' password vaults remained encrypted at all times, even after exfiltration by the threat actor.
What is known
| People affected | Not stated in the sources we have |
|---|---|
| Disclosed | Nov 20, 2025 |
| Attack | Not stated |
| Data exposed | Not stated |
| Sector | Tech · GB |
| Status | Settled |
| Lawsuit or fine | UK ICO fine of £1,228,283 (2025-11-20) |
Sources
| Source | |
|---|---|
| UK ICO fine: LastPass UK Ltdico.org.uk · Regulator | Regulator |
Notices filed
| Where | Filed | People |
|---|---|---|
| UK ICOregulator:GB | Nov 20, 2025 |
History of this record
- 2026-09-25 · added · backfill source
First seen 2026-09-25 (UK ICO), confirmed by UK ICO. Record counts are as reported. Not legal advice.