If you typed your master password into LastPass this week and felt a small pang of dread, you weren't being paranoid.
Security researchers say a fresh wave of credential-stuffing attacks is hammering LastPass accounts, using email and password combinations that trace back to the 2022 vault theft.
The company says its systems weren't breached again.
That's technically true, and almost beside the point.
Attackers took old breach data, ran it through automated login tools, and started knocking on doors.
Some users received alerts about blocked login attempts from unfamiliar countries.
Others discovered their email addresses circulating on forums alongside passwords they hadn't changed since the first breach.
The vaults stolen in 2022 were encrypted, but the URLs inside them weren't, which handed criminals a map of exactly which accounts were worth attacking.
This is the part that should bother you more than the headline.
It just entered a slower phase, one where a stolen password from three years ago becomes a Tuesday morning problem.
Any password manager is a single, gloriously tempting target: crack one vault and you get everything.
That's the trade-off nobody mentions at signup.
The American habit of setting it and forgetting it is doing real damage.
We treat a password like a home address, something you memorize once and keep forever.
Security professionals treat it like a carton of milk.
The average person reuses credentials across roughly a dozen accounts, according to multiple consumer surveys, which means one old leak can cascade through banking, email, and shopping logins in an afternoon.
First, if you're still on LastPass, change your master password today and turn on two-factor authentication with an app rather than SMS.
Second, rotate passwords on any account that shared credentials with your vault.
Third, consider whether you want your entire digital life behind one company's incident response team.
Competitors like 1Password and Bitwarden make the same fundamental promise, and they've had their own scares.
The deeper issue is that we've outsourced a core piece of personal security to subscription software and then stopped thinking about it.
That's not laziness so much as rational behavior in a world that demands forty unique passwords.
But rational or not, it leaves millions of Americans one recycled login away from a very bad week.
The honest takeaway: a password manager is still better than reusing "Summer2024!" everywhere, but only if you treat it as a living system rather than a set-and-forget appliance.
Final Thoughts
Rotate your master password, enable real two-factor authentication, and assume any credential older than a couple of years is already someone else's problem.