Quick Answer — On December 22, 2022, LastPass confirmed the worst-case follow-through of its August breach: attackers who compromised a DevOps engineer’s home computer used stolen credentials to reach the company’s cloud storage and copied a backup of customer vault data. The vaults were encrypted, but URLs, notes, and form-fill metadata were not — and master-password KDF settings determined who was actually at risk. The lesson: a password manager is a tier-0 system, and its users’ security is set at the weakest KDF default the vendor ever shipped.
What happened
- Act One — August 2022. Source-code repo breach via a compromised developer endpoint. LastPass said no customer data was touched. True then — but the attacker got something better: knowledge of the environment.
- Act Two — the pivot. Using intel from Act One, the attacker targeted a DevOps engineer with elevated cloud-storage access, compromised their home machine, installed a keylogger, and captured a master password to the DevOps vault embedding the company’s cloud-storage keys.
- December 22 confirmation. Cloud storage breached; copied: customer account data (email, billing, phone, IP) plus encrypted vault backups. Encrypted fields remained protected by each user’s master password; unencrypted fields (URLs, usernames, notes… form-fills) did not.
Damage assessment by KDF setting
| User cohort | Risk |
|---|---|
| Default PBKDF2 600k-iteration config (post-2018 era) | Brute-force of master password impractical for strong passphrases |
| Older accounts defaulted to low iterations (e.g., 500 or fewer — some 1) | Weak master passwords crackable on commodity GPU rigs |
| Never-logged-in-since-2018 legacy accounts | Worst cohorts; long-expired defaults never upgraded |
| All vaults regardless of KDF | Metadata leak: which sites you have, usernames, URLs — a targeting map |
Why “encrypted” wasn’t the comfort it seemed
The vault problem decomposes into three separate exposures. First, metadata: unencrypted URL and username fields told an attacker exactly which banks, brokers, and corporate logins each victim used — premium phishing targeting, no decryption needed. Second, KDF debt: PBKDF2 iteration defaults were raised over the years (500 → 5,000 → 100,000 → 600,000 for some paths), and the breach’s victim list included accounts created under every era; a user with a 2012 default and a modest master password effectively had their vault handed over crackable. Third, the company vault itself: the DevOps password safe holding cloud-storage keys was protected by one engineer’s master password behind a keylogger — the very definition of single-point failure.
Timeline
| Date | Event |
|---|---|
| 2022-08-25 | Dev-repo breach disclosed (Act One); “no customer data” |
| 2022-11-30 → 12-14 | Weird activity on cloud storage; investigation |
| 2022-12-22 | Confirmation: customer account data + encrypted vault backups copied |
| 2023-02 → 09 | Fake-LastPass-app scams, credential-stuffing waves tied to stolen emails |
| 2023 onward | Third-party analyses quantify crackable cohorts; lawsuits and probes proceed |
What to do about it now
- Audit the KDF, not just the password. If a manager (any manager) still runs low PBKDF2/Argon2 settings, raise iterations; modern guidance is 600k+ PBKDF2 or memory-hard Argon2.
- Rotate secrets that lived in metadata-bearing vaults. Even “uncracked” vaults leaked site inventories; assume target-lists are public.
- Treat vendor DevOps vaults as internet-facing tier-0. One engineer’s endpoint + one master password reached production cloud keys — phishing-resistant MFA and hardware keys belong there first.
- Segment backups. A cold copy of every customer vault in one storage bucket is an exfiltration jackpot; per-tenant encryption keys limit blast radius.
- Users: passphrase length beats cleverness. Six-word diceware beats “P@ssw0rd!2” against a decade of GPU progress.
Why it still matters in 2026
The breach became the canonical case that password-manager security is a systems property, not an encryption checkbox: supply chain in (media package), endpoint compromise (engineer’s home rig), credential theft (keylogger), vault pivot, cloud keys, exfil of backups — a full kill chain against a crown-jewels system, executed with patience across four months. Vendors responded industry-wide with per-user encryption salts out of reach of employee accounts, mandatory KDF migrations, and breach disclosures that now routinely name unencrypted fields. For defenders, the durable takeaway is the two-act structure: an initial “harmless” intrusion that funds a targeted second act months later. Incidents don’t end at containment — they end when the intel gained is expired.
Were the vaults actually cracked?
At scale, no proof emerged of mass decryption — consistent with strong KDF settings holding. But researchers demonstrated that legacy low-iteration vaults with weak master passwords were crackable in practical time, and the population of such accounts was non-trivial. The honest framing: the theft created a decade-long cracking lottery ticket for the attacker, priced per victim by their KDF era and passphrase strength.
Did MFA save anyone?
LastPass’s own MFA protected access to the service going forward — but the stolen goods were offline backups. MFA does nothing against a copied encrypted blob; it gates interactive login. That asymmetry (live-service protections vs. stolen-at-rest data) is why the incident drove the industry toward zero-knowledge architectures where the vendor literally cannot produce a decryptable copy and why KDF strength became part of the “is my vault safe” question.
What about the August “no customer data” statement?
Technically accurate for August’s scope — and a masterclass in why incident language must bind to threat-model horizon. The August attacker exfiltrated no customer data in that act; what they took was environment knowledge that made December’s act possible. Disclosure regimes since have moved toward describing stolen capability, not just stolen records.
Part of the hmmnm.com security-timeline series — one event per month, 2021–2024, indexed here.
