2022 August–December breach — vault data stolen

2022 Unknown records affected

Data compromised

Passwords, Usernames, Names, Source code

Technical writeup

Two incidents: August—developer laptop compromised, source code and backup encryption key stolen. December—DevOps engineer phished, vault keys stolen. Customer account info and encrypted vault data (URLs, usernames, passwords) obtained.

Root cause

Phishing; developer laptop compromise; credential theft.

References

https://blog.lastpass.com/posts/notice-of-security-incident