By 
Is it still safe? The quick summary
- The 2022 theft remains the real event: vault backups went, URLs in clear text with them.
- June 2026 was a supplier incident. Support-case and sales data went. Vaults did not.
- The settlement pays up to $24.45 million, US class only. Claims closed on 2 July 2026.
- Stay on cleaned-up terms: fresh master password, MFA, no seed phrases in the vault.
- Switch if any of those break. Seeds in the vault means the vault is burned.
The emails kept arriving like a steady drumbeat. Your vault, the 2022 theft, the cleanup, always the cleanup. I lost my own vault in that mess and spent six months scrubbing every account back to safety.
You probably got the same mail on your my phone, on the couch, and bookmarked the idea of fixing it. This is the whole story priced in plain money: what happened, what changed at LastPass, who should stay and who should switch.
One honest line first: nothing on this page pays me. Every link here is a plain link, and the full affiliate disclosure is one tap away.
2022: when the emails started
Between 8 and 11 August 2022, someone compromised a developer's laptop at LastPass and walked out with 14 source code repositories. The same grab included the encrypted key guarding the AWS S3 backup buckets. Wikipedia's breach article, read on 13 November 2026, carries the timeline.
On 12 August 2022, a senior DevOps engineer's home PC fell to an unpatched Plex server. A keystroke logger caught that engineer's master password.
On 20 August 2022, the attacker pulled the engineer's employee vault, the one holding the keys. The user database and the encrypted vault backups followed by 16 September. AWS alerts fired on 15 and 22 October 2022, and a mailing-list error hid them until 2 November.
LastPass said on 25 August 2022 that it had seen no evidence of customer data access. On 15 December 2022 it confirmed the backup database was copied. Its incident notice states it plainly.
Those backups held vaults under 256-bit AES, plus names, emails, billing addresses, partial card digits, IP addresses and plain-text URLs. The 2018 defaults were not met by every account: 12-character master passwords, 100,100 PBKDF2 iterations.
I still have the mail from that week. The tone was calm. The situation was not.
What followed: seeds, suits and a fine
Krebs on Security tallied more than 150 cracked vaults and over $35 million by September 2023. In March 2025, investigators tied a $150 million heist to the same breach.
malcare's review, updated 12 May 2026, puts the late-2024 wave at about $5 million. Encrypted passwords have never been publicly confirmed cracked at scale. The linked cases involve seed phrases.
The UK's ICO fined LastPass UK Ltd £1,228,283 on 20 November 2025, over failures affecting more than a million UK data subjects. The sum was cut 30 percent to reflect measures in place and added afterwards.
In September 2025, LastPass finished encrypting URL and URL-related fields, phase two of a project started in 2024. Until then, every URL in every stolen vault sat in clear text.
In January 2026, a phishing wave began on or around 19 January, pushing fake 24-hour vault-backup mail. A second wave followed on 22 January. LastPass's January 2026 notice is plain: no one at LastPass will ever ask for your master password.
The six-month scrub I did was not exotic. It was boring and slow, and it was overdue.
June 2026: a supplier, not the vault
On 12 June 2026, LastPass learned that Klue, a market-intelligence platform it uses, had been compromised. Hackers used Klue's OAuth tokens to enter its Salesforce. Its security notice, published 22 June, owns the dates: ten days from discovery to disclosure.
What was taken: names, phone numbers, emails, physical addresses, support-case data and sales data. What was not: vaults or infrastructure. The same notice says there is no evidence the actor reached Gong data.
TechCrunch, read on 13 November 2026, reports Icarus took credit for the Klue hack. It counts LastPass at 33 million-plus users, with 1.6 million paying customers as of 2024.
The Klue damage is ordinary, and that is what makes it annoying. Support cases likely carry fragments of private data, and exposed contacts make convincing lures. LastPass told customers to expect phishing built on both. The vault was not opened.
One thread runs through all of it: 2022 took the vaults, 2026 took the contacts.
The settlement, in two pools
Wikipedia prints $24.5 million, $16 million for crypto. Claim Depot's tracker, updated 31 October 2026 and read on 13 November 2026, breaks it down pool by pool. The split: $8.2 million cash, a $16.25 million capped crypto pool, $24.45 million in total if every dollar is paid.
Both figures describe the same ceiling two ways: $24.5 million rounded, $24.45 million itemised. The itemised caps decide who got what.
The cash pool covers $25 statutory payments, up to $300 ordinary and up to $10,000 extraordinary. Everything is pro rata, so a heavy claims week shrinks every payment. Crypto victims can claim up to $900,000 each.
Claims closed 2 July 2026, and a final approval hearing was held on 14 July 2026. Claim Depot's 31 October 2026 update note and claimmoney.com both report the court approved on 30 September 2026. Payments expected from September or October 2026 remain unconfirmed, and the crypto pool pays around March 2027. The class is US residents and US-registered businesses.
| The pool | The cap | Who is in | Status |
|---|---|---|---|
| Cash fund | $8.2M | Class members: $25 statutory; up to $300 ordinary; up to $10,000 extraordinary; pro rata | Claims closed 2 July 2026; hearing held 14 July 2026 |
| Crypto pool | $16.25M | Validated crypto victims, up to $900,000 each, pro rata | Payment around March 2027 at the earliest |
| Fees, both pools | Up to $2,870,000 from cash; up to $5,687,500 from crypto | Class counsel; $140,000 service awards from cash | Taken from the funds, not on top of them |
LastPass pays up to $24,450,000 in total. Readers outside the US sit outside this class, so no docket carries a foreign name and no cheque is coming. What is yours is the habit.
The rebuild, priced honestly
The rebuild is the part every vendor page wants to be judged on. Here is the grade: what changed, what holds and what loses.
What changed at LastPass
LastPass's own security page claims 600,000 PBKDF2 iterations, up from 100,100 in 2022. It lists SOC 2 Type II, ISO 27001, SOC 3, BSI C5 and TRUSTe, an IRAP assessment and a Google Play Independent Security Review. The same page calls the company more secure than ever and describes a secure software factory with SBOM tracking and SLSA compliance. Treat those as vendor claims.
The Trust Center holds the underlying reports. I have not audited them, and I am not going to pretend otherwise.
What holds
malcare's review, updated 12 May 2026, confirms zero-knowledge AES-256 with PBKDF2 SHA-256. It also confirms URL-field encryption finished in September 2025, and legacy iteration counts that kept old vaults on weak maths for years. The rebuild is real.
What loses
The trust gap is rational, because a certificate is not a pardon. Certs say an auditor saw controls on certain dates. They do not unsay 2022, and they do not resurrect stolen data.
Stay or switch: the triggers
The stay case is real, with conditions. malcare models it: you changed your master password, rotated your key accounts, turned on MFA and never stored seed phrases. Then the breach is history.
The switch case is also real. Seeds or private keys in any cloud vault are the one automatic fail. Vaults cracked offline do not refund what is spent. Leave, and treat every stored secret as exposed.
The picks live in our best password manager guide for Android, which names Bitwarden for free and 1Password for paid. The 1Password versus Bitwarden duel is its own guide, and it is not written yet.
On a metered plan, the budgeting case is short: Bitwarden costs nothing. Nothing beats nothing. The 1Password trial is there when you want more, and the household plan read $4 monthly in malcare's May 2026 review.
| The profile | The verdict | The first step |
|---|---|---|
| Fresh master password, MFA on, no seeds | Stay, fairly | Run the security dashboard audit |
| Seeds or private keys ever in the vault | Switch, today | Move secrets to cold storage; change every account they touched |
| Never rotated anything after 2022 | Switch | Start with email, banking, SIM portal, then Google or Apple ID |
| Trust broken for you, permanently | Switch | Export, import, delete the CSV, re-enrol 2FA |
| Likes the product, casual about hygiene | Stay with terms | Fresh master password; MFA on; dashboard audit this week |
| Household sharing; Families value | Stay, decent value | Household plan: malcare read $4 monthly in May 2026 |
| Wants open source or a cleaner breach story | Switch | Bitwarden (free, open) or 1Password (paid, trial first) |
Every stay row ends the same way: MFA, no seeds. Every switch row starts on a desktop browser, because phone export is where migrations die.
The 30-minute move
PanicVault's switch guide, updated 4 November 2026 and read on 13 November 2026, times the move at about 30 minutes on a desktop browser. The path: LastPass.com, Advanced Options, Export, CSV, then import.
What breaks: shared folders, file attachments, password history, TOTP secrets in LastPass Authenticator and form-fill data. The sharer hands over the shared folders separately. The CSV is your whole password list in plain text. Delete it after import, and empty the bin.
Re-enrol two-factor codes before you delete anything. For every account on LastPass Authenticator, turn 2FA off there, turn it on in the new manager, and save the recovery codes. Skip that and you will lock yourself out.
Spot-check email and banking before you trust the import. The new manager installs from its official store listing: Bitwarden or 1Password.
If you stay, keep the app updated. The official Android build is on Play, and a stale install is how patched bugs come back.
Run both managers for two weeks, then deactivate the old one: Account Settings, My Account, Delete Account. It is one-way, so export first, always.
The Nigeria note
The settlement excludes you. The class is US residents and US-registered businesses, so no docket carries your name. Your main risk is phishing, and no payout is coming.
The free tier limits you to one device type, computers or phones, and includes dark web monitoring for a small set of email addresses. Both limits are the deal as sold, as malcare's review puts it.
A vault does not stop a SIM swap. Whoever holds your line gets the one-time codes. Lock your SIM with a PIN and never share an OTP, not even for "verification".
The decision here is about trust. My method sits in how we test.
Everything here was checked against Wikipedia and the claims trackers. The courts shuffle docket numbers week to week, so never file off this page alone.
Questions readers ask
Is it still safe to use?
Fairly, on cleaned-up terms: fresh master password, MFA, no seed phrases, an audited vault. The rebuild is real. The trust gap is yours to price.
Were the June 2026 vaults stolen?
No. The June 2026 incident hit a supplier, Klue. Names, contact details and support-case data went. Vaults did not, as LastPass put it on 22 June 2026.
Were the 2022 vaults cracked at scale?
No public confirmation of password cracking at scale exists. The confirmed losses were crypto: more than 150 thefts in 2023 and a $150 million heist in 2025.
Does anyone in Nigeria get settlement cash?
No. The class is US-only. Claims closed on 2 July 2026. Readers here keep the habit, not the cheque.
Should I stay or switch?
Switch if seeds ever sat in the vault, you never rotated after 2022, or the trust is gone for good. Stay only on the cleaned-up terms in the triggers table above.
What to do next
Stay: fresh master password, MFA on, dashboard audit today. Switch: desktop export, import, delete the CSV, re-enrol 2FA, deactivate after two clean weeks. Either takes less time than the 2022 cleanup people are still attempting.
Stay on cleaned-up terms only, or switch to something cleaner. There is no third option.
Comments
New posts held for reviewCouldn't load comments - the thread service didn't answer. Nothing is being hidden: no approved comments are saved with this page.
No approved comments yet - the first one is yours. New posts are held for review before they appear.