ALT-51 · Analysis · 23 Oct 2026
LastPass, 2022: the vaults left the building
Two linked intrusions ended with attackers copying backups of customers' password vaults. Vault contents were encrypted; website addresses were not. What “zero-knowledge” protected, and what it didn't.
- Aug 2022First incident disclosed: source code and technical information taken.
- 22 Dec 2022LastPass discloses that vault backups were copied.
- 1 Mar 2023LastPass describes the second attack on a DevOps engineer's home computer.
What encryption protected
Encrypted vault fields can only be opened by guessing the master password. How hard that is depends on the password's strength and on the number of key-derivation iterations — and older accounts sometimes had far fewer iterations than the current default.
Our reading
Analysis — Altumptic's interpretation of the sources below.
- Zero-knowledge designs move the risk to the master password; they do not remove it.
- Metadata left unencrypted is still sensitive data.
- Employees' home devices became part of the attack surface.
What to do
- If you used LastPass before 2023, rotate the passwords that were stored in it, starting with the most important.
- Encrypt metadata as well as secrets in anything you design.
- Restrict production access to managed devices.
Sources
- LastPass — Notice of recent security incident (Dec 2022)
- LastPass — Security incident update and recommended actions (Mar 2023)
Altumptic has no involvement in these incidents and no non-public information about them. Figures are as reported by the sources above on the dates given.
Cite this entry
Altumptic Lab (2026). ALT-51 — LastPass, 2022: the vaults left the building. 23 Oct 2026. altumptic.com/research/lastpass-2022