Nearly three years after attackers walked out of LastPass with vaults full of customer data, the company has confirmed that more users were affected than anyone previously disclosed.
The admission landed quietly, as these things tend to, and most Americans scrolled past it on the way to something louder.
Here is what actually matters for the roughly 33 million people who use the service: encrypted password vaults, names, addresses, phone numbers, and billing details were taken.
The problem is everything wrapped around it.
For anyone with a weak master password, a reused one, or an old account they forgot about, "strong encryption" becomes a technicality rather than a defense.
LastPass is now telling users, years later, that the scope was bigger than the original statements suggested.
If you have already rotated your passwords and moved on, you are probably fine.
If you shrugged and assumed it was handled, you are the exact person this disclosure was aimed at.
It is a story about the way Americans now live: one master password guarding the email, the bank, the pharmacy account, the IRS login, the smart doorbell, and the thermostat.
We handed a single company the keys to the house, then acted surprised when someone copied them.
Breach fatigue has set in across the country.
We get the notification email, we feel a flicker of alarm, and then we do nothing.
Companies have learned that disclosure carries little cost if the public has stopped reacting.
That is not a technology failure anymore.
It is a civic one, and it is getting worse every year.
Security researchers have been saying for a decade that no single password manager should be a single point of failure.
Use one, absolutely, but layer it: a hardware security key, two-factor authentication that is not a text message, and unique passwords everywhere.
The friction is real, and the payoff is invisible until the day it is not.
The companies storing our most sensitive data have almost no meaningful incentive to protect it, because the penalties are trivial compared to the profits.
Until that changes, we will keep getting emails like this one, in years that arrive too late to matter.
My take: the breach is old, but the disclosure is new, and that gap is the whole scandal.
If you use a password manager, spend twenty minutes this week changing the master password and turning on a security key.
Final Thoughts
It is boring, it is annoying, and it is the only thing standing between you and a very bad month.