LastPass told 33 million users it had "zero-knowledge" architecture — meaning they could never see your data. The 2022 breach proved that was a lie. Website URLs, email addresses, company names, and form field names were all stored unencrypted. Attackers didn't need to crack the vault to know which banks you used, which crypto exchanges you held funds on, and where you worked. "Zero knowledge" meant "we know quite a lot, actually.". LastPass used 5,000 encryption rounds for accounts created before 2018 — the industry standard was 600,000. A single $800 graphics card can try 1.5 million guesses per second against those vaults. Researcher Taylor Monahan tracked 150+ drained cryptocurrency wallets — all former LastPass users. The FBI linked $150 million in crypto theft directly to cracked LastPass vaults. TRM Labs put the total at $438 million. The class action settled for $24.45 million — about 5 cents on the dollar of what was stolen.
What they claim: LastPass claims SOC 2 Type II compliance demonstrating security controls
What we found: Despite SOC 2 certification, a single employee's compromised personal device led to complete infrastructure breach. No public third-party encryption audit has ever been published. Post-breach security engagement was with Mandiant (incident response), not a proactive security audit.
What they claim: LastPass markets itself as a secure password manager that "simplifies everything online" while keeping credentials safe and private.
What we found: German security researcher Mike Kuketz discovered seven embedded trackers in the LastPass Android app in 2021. The trackers included: Google Analytics, Google CrashLytics, Google Firebase Analytics, Google Tag Manager, AppsFlyer, MixPanel, and Segment. Segment is specifically designed to collect data for marketing teams to profile users and connect their activity across different platforms for targeted advertising. A password manager is the single most security-critical app on any phone -- it holds the keys to every other account. Embedding seven trackers, including a marketing profiling tool, in an application designed to protect secrets is an architectural contradiction. By comparison: 1Password contains zero trackers. KeePass contains zero trackers. Bitwarden contains two (Google Firebase and Microsoft crash reporting only). LastPass contained seven, including one explicitly designed for marketing surveillance.
What they claim: LastPass claims 'zero-knowledge' architecture — 'LastPass never has access to your master password'
What we found: The 2022 breach revealed unencrypted vault metadata including website URLs, form field names, and email addresses. Zero-knowledge means the provider can't see ANY user data, but LastPass stored significant user data in plaintext. The stolen vault backups also included unencrypted company names and end-user names.
What they claim: LastPass used PBKDF2-SHA256 with only 5,000 iterations for legacy accounts created before 2018
What we found: FBI linked $150M+ in cryptocurrency theft directly to cracked LastPass vaults. A single RTX 4090 GPU can attempt 1.5 million guesses/second against 5,000-iteration vaults. At least $438M total stolen from LastPass users according to TRM Labs analysis. Class action settlement: $24.45M.
What they claim: LastPass privacy policy states they implement 'appropriate technical and organizational security measures'
What we found: A senior DevOps engineer's personal Plex server (CVE-2020-5741) was exploited to install a keylogger, capturing the master password for LastPass backup infrastructure. Only 4 employees had this access. The attacker maintained access from August to October 2022 undetected.
What they claim: LastPass claims data is 'encrypted at rest and in transit'
What we found: Vault URLs were stored unencrypted, revealing which services users had accounts with. Combined with unencrypted email addresses and company names, attackers could identify high-value targets (crypto holders) without ever cracking the vault encryption.
What they claim: LastPass increased default PBKDF2 iterations to 600,000 in 2023 after the breach
What we found: The iteration increase was not retroactively applied to existing vaults that had already been stolen. The 25.6 million users whose vaults were exfiltrated remain permanently vulnerable at their old iteration count. The fix protects future vaults, not the ones already in criminal hands.
What they claim: LastPass marketed itself as the secure way to store passwords, with "256-bit AES encryption with PBKDF2-SHA256 and salted hashes" protecting user vaults, claiming "even LastPass cannot access your master password."
What we found: In November 2022, attackers stole encrypted backup copies of approximately 25 million customer password vaults. TRM Labs traced over $438 million in cryptocurrency theft directly to cracked LastPass vaults through December 2025. Victims had stored cryptocurrency seed phrases in LastPass "Secure Notes." Attackers cracked weak master passwords offline using powerful computing systems. Older vaults were especially vulnerable -- LastPass had increased minimum encryption iterations over time, but older accounts used as few as 1 round of PBKDF2, far below security standards. Two to five high-value cryptocurrency heists occurred every month from December 2022 through September 2023. Taylor Monahan of MetaMask confirmed: "The common thread among nearly every victim was that they'd previously used LastPass to store their seed phrase." Stolen funds were traced through mixers to high-risk Russian exchanges. The thefts continued through late 2025 -- three years after the breach.
What they claim: LastPass states it uses "industry-standard security practices" and employs defense-in-depth strategies to protect its infrastructure and customer data.
What we found: The catastrophic second stage of the LastPass breach exploited a known vulnerability (CVE-2020-5741) in Plex Media Server running on a senior DevOps engineer's personal home computer. The vulnerability had been publicly disclosed for over two years and a patch was available -- but the engineer's home Plex installation had never been updated. Attackers installed a keylogger, waited for the engineer to authenticate with MFA, then captured the master password. This single employee was one of only four people at LastPass with vault decryption access. The attacker used legitimate credentials, making the intrusion invisible to security monitoring. A password manager protecting 25 million people's secrets was compromised because a single employee didn't update their home media server. The company entrusted vault decryption keys to four people and didn't secure -- or even audit -- their home computing environments.
What they claim: On September 15, 2022, LastPass told customers that an investigation into the August breach determined "the attacker did not access any customer data or encrypted password vaults."
What we found: This statement was materially wrong. The August breach gave attackers the knowledge and access needed to execute a second, far more devastating attack between August and October 2022. Using information stolen in the first breach, attackers identified and compromised one of four DevOps engineers with vault decryption access. By November, attackers had copied encrypted backups of approximately 25 million customer vaults. LastPass didn't disclose the full scope until December 2022, and even then released details incrementally over months -- the DevOps engineer attack vector wasn't revealed until February 2023. CEO Karim Toubba took "full responsibility" on March 1, 2023 -- six months after the initial breach. Users who trusted the September assurance that no customer data was accessed had no reason to change their master passwords or migrate away. By the time the truth emerged, their vaults were already in attackers' hands. The UK ICO found over 1 million UK data subjects were affected and fined LastPass in November 2025.
What they claim: LastPass promotes itself as a secure password manager protecting your digital life
What we found: The ICO fined LastPass £1.23 million for the 2022 breach, which stemmed from a senior engineer's personal Plex server exploit. Staff were encouraged to link personal and business accounts with the same master password. 1.6 million UK users affected. Researchers tracked over $250 million in cryptocurrency stolen from cracked LastPass vaults — thieves systematically cracked encrypted vaults and drained crypto wallets stored inside.
What they claim: LastPass marketed itself as the most trusted password manager with '33 million users'
What we found: UK ICO fined LastPass GBP 1,228,283 for UK GDPR violations. The breach affected over 1 million UK data subjects. LastPass's own MFA database was also compromised, including authenticator seeds and phone numbers used for two-factor authentication.
What they claim: LastPass stores vault data on AWS with 'industry-standard encryption'
What we found: The breach chain exploited the fact that backup decryption keys were accessible to only 4 employees — but one employee's personal computer was sufficient to access everything. The stolen data included API secrets, third-party integration secrets, and customer vault backups.
What they claim: LastPass privacy policy allows data sharing with 'service providers' for 'business purposes'
What we found: LastPass apps contain multiple third-party trackers including Google Analytics, AppsFlyer, and Segment. A password manager sending usage telemetry to advertising-adjacent analytics platforms contradicts the security-first positioning.
What they claim: LastPass positions itself as a trusted security solution, stating it uses "proven technology" to protect user credentials with enterprise-grade encryption.
What we found: LastPass has experienced significant security incidents in 2011, 2015, 2017, 2019, 2021, and 2022 -- six incidents across 11 years. In 2011, unusual network activity triggered a mass password reset. In 2015, email addresses and password reminders were leaked. In 2017, Google Project Zero's Tavis Ormandy found critical vulnerabilities in the browser extension. In 2019, Ormandy found another vulnerability that could leak credentials from the last site visited. In 2021, users were warned their master passwords may have been compromised in credential stuffing attacks. In 2022, the catastrophic two-stage breach exposed 25 million vaults. After the 2015 breach, users were told security was improved. After 2017, the extension was patched. After 2019, another patch. After 2021, another warning. After 2022, $438 million in cryptocurrency was stolen. Each time, LastPass said it had learned. Each time, the next breach was worse.
What they claim: LastPass markets enterprise-grade security with SOC 2 Type II compliance and positions itself as a trusted custodian of organizational credentials.
What we found: LogMeIn, LastPass's parent company, was taken private by Francisco Partners and Evergreen Coast Capital for $4.3 billion in 2020. LastPass was spun off as an independent company in 2022 -- the same year as the catastrophic breach. Private equity ownership is associated with cost-cutting to maximize returns. The breach exploited a lean security architecture: only four employees had vault decryption access, and their home computing environments were not secured or audited. The DevOps engineer's unpatched Plex server on a personal computer -- used to access production vault decryption keys -- suggests insufficient security controls around the most critical access points. Francisco Partners is also the private equity firm that acquired The Weather Channel's digital assets from IBM in 2024. The $24.5 million class action settlement and UK ICO fine represent costs that pale against the private equity acquisition price -- the fine was a rounding error on the leveraged buyout.
What they claim: LastPass CEO Karim Toubba took "full responsibility" for the breach in March 2023 and stated the company was committed to making things right for affected customers.
What we found: The class action settlement reached in December 2025 totaled $24.5 million -- against estimated cryptocurrency losses exceeding $438 million. Of the settlement, $16.25 million was allocated for cryptocurrency losses and $8.2 million for general data protection claims. Individual cryptocurrency theft victims could claim up to $50,000 in documented losses -- a fraction of the six-figure thefts many experienced. Chris Larsen, Ripple's co-founder, lost $150 million in a single theft linked to the breach. The UK ICO separately fined LastPass UK Ltd in November 2025 for failing to implement appropriate technical and organisational measures, affecting over 1 million UK data subjects. "Full responsibility" translated to approximately 5.6 cents for every dollar stolen. The people who lost their life savings to cracked LastPass vaults received a settlement check and a promise that LastPass had learned its lesson -- the same promise the company made after every previous breach.
What they claim: LastPass offers a 'free tier' suggesting password security should be accessible to all
What we found: Following the breach, LastPass restricted free tier features significantly, pushing users toward paid plans. Users whose vaults were stolen on the free tier received no direct notification of their specific risk level or recommended actions.