LastPass Hack: Vaults Stolen, Passwords at Risk

LastPass has announced a major security incident, revealing that hackers successfully copied a backup of customer vault data. This stolen data includes encrypted sensitive fields like usernames and passwords, along with unencrypted website URLs. The company asserts that cracking these vaults would require a user's master password, which LastPass claims to never have access to.

Initially downplaying a breach in August, LastPass later disclosed in November that information from that incident was used to target an employee and gain access to a third-party cloud storage service. It was from this service that the backup of customer vaults was copied. The company stated that there is no evidence of unencrypted credit card data being accessed, but admitted that website URLs were part of the exposed information.

LastPass is implementing enhanced security measures, including increased logging and credential rotation. However, given the handling of disclosures, users are advised to consider migrating away from the service. The breach occurred around December 22, 2026, with the company's announcement timed just before a holiday period when many IT departments would be on leave.