LastPass

LastPass

Basic Information
Release Year	2008
Product Type	Password Managers, Browser extension, Software, Security
In Production
Official Website	https://www.lastpass.com/

LastPass is a password manager application that allows users to store passwords and notes securely using one master password. It was launched in 2008 and was one of the first widely adopted password managers.

In 2015 LastPass was acquired by GoTo (formerly LogMeIn Inc) for $110 million. LastPass was later spun off into it's own company being acquired by private equity firms Francisco Partners and Elliott Management in 2024.

Consumer-impact summary

LastPass, being a password manager, stores and transmits highly sensitive information (passwords and secure notes). LastPass relies on its users trusting it to safely handle this information and have it be accessible.

Use of a subscription service for more device types allows LastPass to restrict where users can view their passwords.

LastPass has suffered a number of security incidents over the years with the most severe being the 2022 data breach which saw encrypted customer passwords and secret notes get exposed. Despite the most sensitive information being encrypted, the vault can be decrypted and was allegedly used in the theft of $35 million in cryptocurrency from 150 victims. In 2025 an even larger theft of $150 million was traced back to the data breach.

Incidents

Free Tier Device Type Restrictions (2021)

See also: Post-purchase EULA modification

On February 16, 2021 LastPass changed its free tier to restrict users to only one device type. After March 16, 2021, if a user was using LastPass on their computer, they would not be able to view their LastPass vault on mobile without paying for premium. These restrictions locked a large number of LastPass's userbase out of their passwords.

2022 Data Breach

In August 2022 and November 2022, LastPass suffered a data breach involving a backup copy of a customer database and customer password vaults. The attackers used a compromised developer account to access source code which contained credentials to the aforementioned backup database. The stolen data included encrypted usernames, passwords and secure notes. It was also discovered that URLs, IP addresses, phone numbers and some emails were unencrypted.

Aftermath

ICO Fine

In December 2025, ICO announced that they had fined LastPass UK Ltd £1.2 million based on their findings following the data breach. They concluded that:

"LastPass failed to implement sufficiently robust technical and security measures, which ultimately enabled a hacker to gain unauthorised access to its backup database."

But also that:

"there is no evidence that hackers were able to unencrypt customer passwords as these are stored locally on customer devices and not by LastPass."

Stolen Crypto

Also in December 2025, TRM reported that their analysts had been able to:

"trace the stolen funds through mixers and ultimately to two high-risk Russian exchanges frequently used by cybercriminals as fiat off-ramps — with one of them receiving LastPass-linked funds as recently as October."

This was reportedly the result of analyzing clusters of wallet drains that occurred after the breach, with waves of them surfacing as late as 2024 and 2025.

'create backup' Phishing Campaign (2026)

On or around January 19th 2026, phishing emails were sent out from multiple email and ip addresses. The emails claimed that maintenance was to be conducted and that LastPass users needed to backup their vaults within 24 hours. They also contained links which took users to a website which allowed them to perform vault "backups." LastPass seems to have detected this relatively quickly as a threat intel blog post was already published on their website by January 20th.

See also

• Data lock-in