Remember when LastPass told everyone their encrypted vaults were basically useless to thieves?
Security researchers have spent months chewing on data stolen during the 2022 breach, and the picture forming now is messier than the company's original assurances suggested.
Here's the short version of what happened.
Attackers hit LastPass twice in 2022, the second time walking off with customer vault backups, names, addresses, and encryption keys derived from user master passwords.
LastPass insisted the vault data was locked down with strong encryption.
The catch: weak master passwords fall fast to offline cracking, and attackers have had years to grind away at them.
Researchers analyzing the stolen data have reportedly cracked large batches of vaults, sometimes in days.
It's the same GPU hardware gamers use, pointed at password hashes instead of frame rates.
When a master password is short, reused, or patterned after something guessable, it might as well be written on a sticky note.
This matters beyond LastPass users, because millions of Americans store everything in one of these apps: bank logins, email, tax accounts, work credentials.
The entire pitch is that you only need to remember one strong password.
That pitch collapses if your one password is "Summer2021!" The uncomfortable truth is that password managers remain safer than reusing the same password everywhere.
But "safer than the alternative" isn't the same as "safe." A vault is a single point of failure by design, and the industry has been slow to admit how much weight that places on one human-chosen string of characters.
If you're still on LastPass, seriously consider switching, and not just cosmetically.
Start by changing the passwords for your email and financial accounts, since those unlock everything else.
If you use any password manager, audit your master password, enable two-factor authentication with an app or hardware key rather than SMS, and check whether your current provider offers passkeys or hardware-backed vaults.
Bitwarden, 1Password, and Dashlane have all been pushing stronger defaults, and Apple and Google now build decent managers straight into their phones.
The bigger lesson is that the password itself is the weak link.
Passkeys, which replace passwords with device-bound cryptographic keys, are finally rolling out across major services.
That transition can't happen fast enough.
My take: LastPass earned the skepticism it's getting, but the real villain is an industry that spent two decades treating one memorized password as adequate protection for your entire digital life.
Use a manager, make the master password long and unique, turn on the strongest second factor you can stomach, and start moving accounts to passkeys wherever they're offered.
Final Thoughts
Your vault is only as tough as the one key that opens it.