LastPass has spent the better part of two years telling anyone who will listen that the December 2022 vault theft wasn't that bad.
Encrypted blobs got taken, sure, but without your master password they were just digital confetti.
And it's technically true right up until it isn't.
Here's the part that keeps nagging at security researchers.
The attackers didn't just walk off with scrambled files and call it a day.
They also grabbed unencrypted data during the earlier August 2022 intrusion, including company and customer metadata.
It tells a thief who has which vaults, how many entries sit inside, and which accounts are worth the effort of a slow, patient crack.
Nobody hacks a vault blind when they can sort the pile first.
Then there's the master password problem itself.
LastPass historically enforced a default of 12 characters, and older accounts carried weaker passwords set years ago, before anyone used the phrase "password hygiene" without smirking.
Cracking a mediocre password protecting a well-built vault is a weekend project for someone with rented GPU time.
The math doesn't care how strong the encryption is when the key is "Fluffy2011!".
Early stories said "encrypted vaults, low risk." Later reporting, pulled from the attacker's own communications, described a campaign specifically targeting cryptocurrency holders, with stolen vaults being cracked and drained.
That's a documented outcome, and it took months to surface because the victims didn't know what hit them.
The gadget angle matters here, because this is where American consumers actually live.
Password managers are baked into iPhones, Android phones, Chrome, and every laptop shipped in the last five years.
So when one of the biggest names in the category gets its vaults lifted, the honest question isn't "is LastPass bad" — it's "why does the entire model depend on one master password I might have set during a bad mood in 2019." Bitwarden, 1Password, Dashlane, and the built-in Apple and Google keychains all share that same single point of failure.
If your master password is weak, reused, or sitting in a note on your phone, no amount of AES-256 saves you.
Thieves don't pick locks when they can find keys.
Rotate your master password if you haven't since 2022.
Turn on two-factor authentication everywhere it's offered, and use an authenticator app rather than SMS.
Check your manager's export and audit features and delete dead accounts you don't recognize.
If you're still on a 12-character password made of words and a birthday, upgrade it today.
The uncomfortable takeaway is that "your data is encrypted" has become a bedtime story the industry tells to end conversations.
Encryption is real and it works, but it works in proportion to how well you guarded the one secret that unlocks it.
Treat your master password like the spare key to your house, not like a login you'll fix later.
Final Thoughts
Later is exactly when the breach shows up.