The headlines blared about a "password manager breach," and the instant reaction was predictable: panic, blame, and a wave of people swearing off password managers forever.
LastPass wasn't broken into because password managers are unsafe.
It got hit because a single employee's home media server was running outdated Plex software.
That detail comes from the company's own disclosures and subsequent reporting, and it changes the entire story.
The vault itself wasn't cracked in some cinematic hack.
Attackers stole encrypted vaults after compromising a DevOps engineer's machine.
What leaked was the metadata—website URLs, usernames, and in some cases, unencrypted notes and form fields.
It's also not the same as your master password walking out the door.
So why did millions of Americans start deleting their accounts in a panic?
The breach became a proxy war in a long-running argument about whether trusting any company with your secrets is foolish.
That argument is emotionally satisfying and practically useless.
The real question isn't whether to use a password manager.
Here's the uncomfortable part the industry quietly skips: the alternative most people actually use is reusing the same three passwords across every account.
A password manager with a strong, unique master password and two-factor authentication is still dramatically safer than your memory—and your memory is what got you into this mess.
The smarter takeaway is about architecture, not abandonment.
Bitwarden is open-source and lets you self-host. 1Password never stores your master password and uses a secret key as a second layer.
These differences matter because they change what a breach can actually cost you.
If your provider gets hit, you want your vault to be useless to anyone who grabs it.
There's also a lesson about the devices in your life that you forget are computers.
Plex servers, smart TVs, old routers, that NAS in your closet—each one is a potential doorway.
Attackers didn't need to defeat enterprise-grade encryption.
They needed one neglected gadget connected to a corporate network.
Most American homes are full of these ticking clocks right now.
Change your master password if you haven't since the incident.
Turn on two-factor authentication everywhere it's offered.
Update the firmware on every smart device in your house, then set a reminder to do it again.
Audit which sites store unencrypted notes in your vault and clean them out.
And if you're still using the same password on your email and your bank, fix that today—before someone else does it for you.
The breach wasn't proof that password managers fail.
It was proof that the weakest link is usually the human who forgot to patch a server.
Blaming the tool lets the real culprit—complacency—off the hook.
Final Thoughts
Stay paranoid about your own habits, not just the company holding your keys.