The email landed in inboxes like a polite burglary notice.
LastPass was telling millions of users that their encrypted password vaults had been copied by hackers—again—months after the company first announced a breach.
The stolen data includes website URLs, usernames, and encrypted passwords.
The company says your master password is safe.
Practically, it's the kind of reassurance that makes security researchers reach for the whiskey.
Attackers first compromised a LastPass developer account in August 2022, then used that access to reach cloud storage where customer vault backups lived.
By December, they'd walked off with the whole filing cabinet.
LastPass has since admitted the attackers also grabbed unencrypted data like company names and billing addresses.
That's a phishing kit assembled for you personally.
The uncomfortable part isn't that LastPass got hit.
It's that the entire pitch of password managers—"put all your eggs in one very secure basket"—assumes the basket never gets stolen.
When it does, the encryption becomes the only thing standing between a hacker and every account you own.
And encryption strength depends entirely on one password you made up years ago and probably reused on a dozen sites.
Security experts have been screaming about this architecture for years.
Bruce Schneier, a longtime cryptography voice, has argued that centralized password vaults create single points of catastrophic failure.
Your bank doesn't keep all its cash in one unlocked room.
Yet we've been trained to store every credential we own behind a single login, then trust a venture-backed startup to defend it forever.
The practical fallout is messier than headlines suggest.
If your master password was strong—long, random, unique—your vault is likely still locked to attackers.
If it was "Fluffy2019!" you should assume everything inside is compromised.
LastPass users are now being told to change their master password, enable two-factor authentication, and rotate credentials for any site stored in the vault.
That's thousands of logins for some people.
The company also faces multiple class-action lawsuits and a wave of users jumping to rivals like 1Password and Bitwarden.
The deeper story is that this keeps happening because the business model rewards growth over paranoia.
Password managers are subscription products.
They need millions of users to justify valuations.
That scale makes them magnets for nation-state attackers who can afford to be patient.
If you use any password manager, audit your master password strength today and turn on hardware-key two-factor authentication.
Better yet, diversify: keep your email and financial logins in your memory or a separate system, and let the manager handle the low-stakes stuff.
And update your passwords after any breach notification, even if the company swears the encryption held.
We outsourced our digital memory to companies that promised convenience and called it security.
Final Thoughts
The LastPass breach didn't break that promise—it revealed the promise was always conditional.