When LastPass disclosed that attackers had walked off with customer vault data in late 2022, the company's messaging was carefully calibrated: passwords remained encrypted, and only users with weak master passwords were truly at risk.
That framing deserves a second look, because the details tucked into the company's own updates tell a messier story than the headline.
Attackers first compromised a developer's machine in August 2022, then used that access to reach a cloud storage bucket holding backups.
Inside those backups sat encrypted vaults, plus something more uncomfortable: unencrypted website URLs.
So while your passwords may have been locked down, the list of every site you hold an account on was not.
That URL data is the part most people glossed over.
A vault isn't just a random pile of logins.
It's a map of your digital life, showing which banks you use, which medical portals you log into, and which obscure forums you signed up for a decade ago.
For anyone trying to craft a convincing phishing email, that map is a gift.
Security researchers have since pointed out that the iteration counts protecting older vaults, the number of times your master password gets scrambled, were set far lower than modern best practice.
Users who created accounts years ago and never updated their settings may have been sitting on weaker encryption than they assumed, despite paying for a premium product.
The bigger takeaway isn't that password managers are broken.
It's that the entire category depends on a single point of failure: one company holding the keys to everything, with your safety resting on how well they configured defaults years before the breach.
If you were a LastPass user, change your master password and rotate credentials for anything sensitive, starting with email and financial accounts, since those unlock everything else.
Better yet, consider a manager that stores your vault locally or uses zero-knowledge architecture more aggressively.
Bitwarden, 1Password, and KeePass all have different tradeoffs, but the point is not to reward a company that buried the scary parts in a security bulletin.
This is the uncomfortable truth about convenience: centralizing your digital life makes you efficient, and it also makes you a target.
The breach wasn't a failure of encryption so much as a failure of transparency.
Companies will keep telling you the vault is safe.
Final Thoughts
Your job is to read what they're not saying.