LastPass was hacked twice in 2022 — the second breach exposed password vaults

In August 2022, LastPass, one of the most popular password managers, disclosed that hackers had accessed its internal systems and stolen source code. The company initially assured users that no customer data had been compromised.

In November 2022, LastPass disclosed a second, more serious breach: the hackers had used information from the first breach to access a third-party cloud storage service and steal encrypted customer password vaults. The vaults contained users' encrypted passwords, website URLs and other sensitive data.

The breach was particularly damaging because LastPass's entire value proposition was security: users trusted the service to protect their most sensitive credentials. The company was criticized for its initial downplaying of the first breach, its slow disclosure of the second, and its failure to protect the cloud storage backup. The case illustrated how a security company's breach is more damaging than any other company's breach, because the product is the trust.