If you use a password manager, you probably did it because some security guy on a podcast told you that reusing "Fluffy2019!" across 47 websites was basically leaving your front door open with a sign that says "free stuff inside." Solid advice.
Except now the thing guarding the front door just got its own door kicked in.
According to a disclosure that's currently making the rounds on every tech subreddit, a widely used password vault confirmed that attackers managed to reach into its systems and walk off with user data.
The company says the encrypted vaults themselves weren't cracked, which is the security equivalent of "the safe is fine, they only took the keys to the building, the floor plans, and everyone's home address." The details matter here, so let's do the boring part quickly.
Reportedly, what got accessed was mostly metadata and account info rather than the actual password blobs.
That's the good news, assuming you trust the entity that just got hacked to accurately describe the thing it just got hacked over.
Which, statistically speaking, is a bold assumption.
Remember, "encrypted" is not a magic word.
It's a promise that only holds until someone finds a way around it, and companies love saying "no plaintext was exposed" right up until the follow-up email three weeks later.
Here's the part that should actually tick you off if you're a paying customer.
You handed this company money specifically so this wouldn't happen.
You sat through the onboarding screens, you generated the 32-character monstrosities, you did the thing where you saved your recovery phrase to a piece of paper and hid it in a drawer like a raccoon with a secret.
And the reward for all that diligence is a notification that says "we take your security seriously." Everybody takes it seriously after the fact.
That's not a security policy, that's a regret.
What you should do right now is annoyingly simple and annoyingly tedious.
Turn on two-factor authentication if you haven't already, and not the SMS kind if you can avoid it, because SIM-swapping is its own whole nightmare.
Then go through your vault and rotate the credentials for anything that touches money, email, or your identity.
No, you don't get to skip the bank one because you're tired.
And if you're sitting there feeling smug because you never used a password manager and just keep everything in a notes app called "important stuff," congratulations, you're not part of this story.
You're part of a different, much older story that ends the same way.
The uncomfortable truth is that no vault is impenetrable, and the whole point of a password manager was never perfection.
It was that one breach beats fifty breaches.
It's just a lot less comforting when the one breach turns out to be the one you paid for.
The takeaway isn't to ditch your vault and go back to memorizing your dog's birthday.
It's to treat this like a smoke alarm that just went off: don't panic, don't ignore it, and definitely don't assume it was a false alarm because the company says so.
Final Thoughts
Rotate your stuff, lock down your 2FA, and remember that the company protecting your passwords is a business, not your friend.