LastPass and the first-draft problem in vendor breach notices

The week

On August 25, 2022, LastPass, a password manager used by consumers and businesses, disclosed that an unauthorized party had gained access to part of its development environment through a compromised developer account. The attacker had taken portions of source code and some proprietary technical information. The company said it had seen no evidence that customer data or encrypted password vaults had been accessed. It noted that its zero-knowledge design meant it never held customers’ master passwords. Many security teams read the notice, judged it a vendor’s internal problem and closed the item. Later disclosures, described below, changed the picture substantially.

A vendor’s first breach notice is written days into an investigation. It reports what the vendor has evidence of, not what the attacker has done, and phrases such as no evidence that customer data was accessed are accurate statements about the evidence at that moment. They are not guarantees. LastPass later said the attacker’s second stage, which led to the theft of vault backups, began within days of the first incident and ran for weeks after the August notice was published.

For banks, health systems and agencies that used the product, or any product that concentrates secrets, the episode separates into three questions. What did the first notice imply, read carefully? What would a vault compromise actually expose in this organization? And how quickly could every stored credential be changed if it came to that?

Reading the first notice

The August notice contained a detail that deserved more weight than it received. The attacker had taken source code and technical information about the environment. In a security product, that kind of material is a map. It can reveal how systems connect, where keys are stored and which people hold privileged access. A careful reader would have asked what the stolen information could enable next, and whether the vendor had rotated every secret that might have been visible in the development environment.

Turning that reading into practice means treating significant vendor disclosures as open risk items rather than news. Each gets an owner, a review date and written questions to the vendor. What exactly was taken? Which credentials, keys and certificates were rotated? Is the investigation complete, and who is conducting it? Will customers be told if the scope changes? The answers, or the lack of them, go into the vendor risk file and the next renewal discussion.

Contract terms help here. A clause requiring the vendor to update customers as material facts change, not only at the first notice, turns a courtesy into an obligation. Few software contracts in 2022 had one.

What the vault exposes

Password managers encrypt vault contents with a key derived from the user’s master password, which the vendor does not hold. The design is sound. Its strength in a theft depends on details that most customers had never checked.

The first detail is the master password itself. A long, unique passphrase resists offline guessing far longer than a short reused one. The second is the key derivation setting. Accounts created years earlier could carry weaker defaults than new ones, which made them cheaper to attack offline. The third is what is encrypted at all. Some fields, such as the website addresses attached to entries, were stored without encryption. That can reveal which services, banks and administrative consoles a user has accounts with, even if the passwords stay protected.

The fourth detail is what people put in the vault. Ordinary user passwords are one thing. Shared administrator credentials, cloud access keys, recovery codes, VPN secrets and private notes describing infrastructure raise the stakes far beyond that. An enterprise deployment with enforced strong master passwords, current settings and policies on what may be stored is a very different exposure from a collection of personal accounts used for work.

Security teams could answer most of these questions from the product’s admin console. Few had looked before August 2022.

Rotating at scale

If a vault may be exposed, the response is rotation: change every credential stored in it, starting with the most sensitive. Most organizations had never rehearsed that. They did not know how many secrets were stored, who owned each one, or how long changing them all would take.

A rotation plan answers those questions before they are urgent. It classifies stored credentials by sensitivity and names an owner for each class. It documents how each class is changed, including any that require a maintenance window or a vendor’s help, and sets target times. Cloud administrator keys and production database credentials come first, then payment and banking portals, then the long tail.

Rotation takes time, so detection fills the gap. While credentials are being changed, the security team can watch for their use. Signals include unusual logins to the services listed in the vault, new API keys created in cloud accounts, and access from unfamiliar locations to banking and payment portals. Knowing which services are in the vault, from the unencrypted website list, tells the team where to look first.

The plan also changes where secrets live. The most sensitive machine credentials belong in dedicated secrets management tools with automated rotation, not in a general password manager shared by people. Moving them shrinks the blast radius of any future vault compromise and makes rotation a scheduled job rather than an emergency.

Staff communication is part of the plan. People need clear instructions on what to change and in what order, and a way to ask questions. A rotation that leaves staff unsure whether to start with personal or shared credentials will be slow and uneven. A short tabletop exercise, run once a year, shows whether the plan works.

With hindsight

The sequel arrived in stages. In late 2022, LastPass disclosed that the attacker had used information from the August incident to reach cloud storage and copy backups of customer vault data. The backups held encrypted fields and some unencrypted data such as website addresses. In early 2023 it said the second stage had involved compromising a senior engineer’s home computer through vulnerable third-party software, giving the attacker credentials for that storage. Security researchers later linked a series of cryptocurrency thefts to data taken in the breach. In December 2025, the UK Information Commissioner’s Office fined LastPass’s UK entity 1.2 million pounds over the incident. By 2026 the case is a staple of vendor risk training. Its three practical points have held: first notices are provisional, vault exposure depends on settings and contents, and rotation needs a rehearsed plan.