--- key: "case-study-lastpass-2022" title: "Case study: the LastPass breach (2022)" url: "https://softwaresecurity.com/domains/identity-crypto/secrets/case-study-lastpass-2022/" api: "https://softwaresecurity.com/api/v1/articles/case-study-lastpass-2022.json" domain: "identity-crypto" topic: "Identity \u0026 cryptography" type: "Case study" identifiers: ["CWE-522","CWE-916","CWE-311","CWE-1104","A04:2025","A07:2025","A02:2025","V13.3.1","V13.3.2","V11.4.2","V14.2.4","CAPEC-568","CAPEC-55"] tags: ["Access control","Password storage","Secrets management","Encryption","Incident response"] stages: ["design","build","operate","respond"] roles: ["appsec-engineer","platform-sre"] license: "CC-BY-4.0" license_url: "https://creativecommons.org/licenses/by/4.0/" code_license: "MIT" --- # Case study: the LastPass breach (2022) How an attacker went from a compromised developer laptop to a DevOps engineer's home computer, the keys to LastPass's cloud backups and a copy of customer vaults; why each vault's safety then rested on its master password and PBKDF2 iteration count; and what it teaches about backup keys, privileged endpoints, KDF upgrades and unencrypted metadata. Canonical URL: https://softwaresecurity.com/domains/identity-crypto/secrets/case-study-lastpass-2022/ ## In short In 2022 an attacker stole LastPass source code, technical information and internal secrets from a development environment, then used them to target one of four DevOps engineers who could reach the keys to production backups. A keylogger, planted through vulnerable media software on the engineer's home computer, captured the master password after MFA and opened the engineer's corporate vault, which held the backup decryption keys. The attacker copied customer vault backups in which website URLs were unencrypted and each vault's secrets were only as strong as its master password and PBKDF2 iteration count. - Incident 1, disclosed on 25 August 2022: a software engineer's corporate laptop was compromised, and source code, technical information and internal system secrets were taken from a cloud development environment. - Incident 2, from 12 August to 26 October 2022: the attacker used that material to go after one of four DevOps engineers with access to the decryption keys for production backups, through the engineer's home computer. - A keylogger captured the master password after the engineer had completed MFA, so MFA did not help; the corporate vault held the keys to the AWS S3 backups. - The copied vaults held unencrypted website URLs next to AES-256-encrypted fields, so attackers could pick high-value targets and guess their master passwords offline. - LastPass raised its default from 5,000 to 100,100 PBKDF2 iterations in 2018 but did not move every existing account; some were found at 5,000, 500 or even 1. - Researchers and a US court filing later tied cryptocurrency thefts to the stolen vaults, and the UK ICO fined LastPass UK £1.2 million in 2025. ## Incident at a glance - Date: 2022-08 to 2022-10-26 - Category: Data breach - Organizations: LastPass; GoTo - Impact: The attacker copied customer account data and encrypted vault backups, with website URLs left unencrypted, plus internal secrets and an MFA seed database. Each vault was then only as safe as its master password and PBKDF2 iteration count. - How it was found: LastPass detected unusual activity in its development environment in August 2022, and in a third-party cloud storage service shared with its affiliate GoTo in November 2022. ### Timeline 1. 2022-08-12: Incident 1 ends: source code, technical information and internal secrets have been taken from a development environment. 2. 2022-08-12: Incident 2 begins: reconnaissance and exfiltration in the cloud storage environment with a DevOps engineer’s credentials. 3. 2022-08-25: LastPass discloses the first incident. 4. 2022-10-26: The last attacker activity LastPass observed. 5. 2022-11-30: LastPass reports unusual activity in a third-party cloud storage service. 6. 2022-12-22: LastPass discloses that customer account data and vault backups were copied. 7. 2023-02-27: LastPass publishes the attack path through a DevOps engineer’s home computer. 8. 2023-09: Researchers link cryptocurrency thefts to seed phrases stored in LastPass vaults. 9. 2025-03-06: A US forfeiture complaint ties a $150 million crypto theft to the 2022 breach: the thieves used a password stored in the victim’s vault. 10. 2025-11-20: The UK ICO fines LastPass UK Ltd £1.2 million; it announces the fine on 11 December. ## Recommended defaults | Setting | Value | Note | Source | | --- | --- | --- | --- | | Incident 1 disclosed | 25 August 2022 | Source code and technical information taken from a development environment. | LastPass notice of security incident | | Backup copy disclosed | 22 December 2022 | Customer account data and a backup of customer vault data. | LastPass notice of security incident | | Attack path disclosed | 27 February 2023 | A senior DevOps engineer's home computer, a vulnerable third-party package and a keylogger. | LastPass Incident 2 details, as quoted by Sophos | | Attacker activity in cloud storage | 12 August to 26 October 2022 | — | LastPass Incident 2 details, as quoted by Sophos | | PBKDF2 iterations | Default 100,100 from 2018; at least 600,000 for new accounts today | Older accounts were reported at 5,000, 500 and 1. | LastPass Trust Center; Wladimir Palant | | Software reported exploited | Plex Media Server, CVE-2020-5741 | LastPass did not name it; added to CISA KEV on 10 March 2023; fixed in Plex Media Server 1.19.3 in May 2020. | BleepingComputer; CISA KEV | | UK regulator | ICO fined LastPass UK Ltd £1.2 million on 20 November 2025, announced 11 December | Up to 1.6 million UK users affected. | Information Commissioner's Office | ## Verify it 1. List where your backup decryption keys live and who can read them, and confirm no single engineer's vault, laptop or password manager holds them. 2. Confirm that production keys and backups can be reached only from managed devices with phishing-resistant MFA, not from personal computers. 3. Query your user records for key-derivation or password-hash parameters below the current floor and confirm an upgrade path exists for accounts that never log in. 4. List every field you store unencrypted next to encrypted customer data, and decide for each whether its disclosure would help an attacker choose targets. 5. Confirm that after an incident you can enumerate and rotate every secret the attacker could have read, including MFA seeds and integration keys. ## What you will learn - Trace the attack from the first incident to the stolen vault backups and name the control that would have broken each step. - Explain why a vault copied offline is protected only by its master password and KDF parameters. - Calculate how the iteration count changes the cost of guessing a master password. - Apply the lessons to your own backup keys, privileged endpoints, KDF upgrades and metadata. Audience: Engineers and security teams who run services that store customer secrets or encrypted customer data, and the platform teams who hold the keys to production backups. Before you start: - Know what a key derivation function such as PBKDF2 does and why its iteration count matters. - Read a simple cloud architecture: storage buckets, backups and the keys that decrypt them. - For the exercise: a calculator; no tools to install. Time: About 30 minutes: 8 to read and 22 for the exercise ## Two linked incidents in 2022 LastPass first disclosed a breach on 25 August 2022: an attacker had reached a development environment and taken source code and technical information. LastPass later explained that a software engineer's corporate laptop had been compromised, and that internal system secrets were also taken, but no customer vault data. On 30 November 2022 it reported unusual activity in a third-party cloud storage service, and on 22 December 2022 it said that the attacker, using information from the first incident, had copied customer account data and a backup of customer vault data from that service. LastPass's February and March 2023 updates gave the attack path, and said it had seen no attacker activity after 26 October 2022. This page sticks to what LastPass, the UK regulator and named researchers have published. LastPass never named the third-party software used against its engineer, and the links between later thefts and cracked vaults come from researchers and investigators, not from LastPass. | Date | Event | | --- | --- | | August 2022 (four days, ending 12 August) | Incident 1: a software engineer's corporate laptop is compromised; source code, technical information and internal secrets are taken from a cloud development environment. | | 12 August to 26 October 2022 | Incident 2: reconnaissance, enumeration and exfiltration in the cloud storage environment, using a DevOps engineer's credentials. | | 25 August 2022 | LastPass discloses the first incident. | | 30 November 2022 | LastPass reports unusual activity in a third-party cloud storage service it shares with its affiliate GoTo. | | 22 December 2022 | LastPass discloses that customer account data and vault backups were copied. | | 27 February and 1 March 2023 | LastPass publishes the attack path, then a summary with its remediation. | | 10 March 2023 | CISA adds CVE-2020-5741, the Plex Media Server flaw that Ars Technica reported was used, to its Known Exploited Vulnerabilities catalog. | | 20 November 2025 | The UK ICO fines LastPass UK Ltd £1.2 million (announced 11 December). | ## From a developer laptop to the backup keys The production backups were encrypted, and only four DevOps engineers had access to the corporate vault folder that held their decryption keys. The attacker went after one of them at home. According to LastPass, a vulnerable third-party media software package on the engineer's personal computer gave the attacker remote code execution, which was used to install a keylogger. The keylogger captured the engineer's LastPass master password as it was typed, after the engineer had completed MFA, and the attacker used it to open the engineer's corporate vault and its shared folders, which held the keys and credentials for the AWS S3 production backups and other cloud storage. Each step used legitimate access, which is why it was hard to see. The material from the first incident told the attacker whom to target; the home computer sat outside corporate controls; the keylogger made MFA irrelevant because it waited until MFA was done; and the engineer's own credentials were then used against the storage service. The UK ICO's summary matches this sequence: a corporate laptop in Europe first, then a US-based employee's personal laptop, where malware captured the master password. The lesson is about where keys live. One shared folder in a person's password vault held the keys to every customer's encrypted backup. Keys that open all customer data belong in a key management service whose policy requires a separate, audited role, ideally with more than one person, reachable only from managed devices, so that one compromised person or endpoint cannot export them. The envelope encryption guide at /domains/identity-crypto/key-management-pki/envelope-encryption-rotation/ shows that design. ## What the backups contained LastPass said the copied data included basic customer account information and metadata: company names, end-user names, billing addresses, email addresses, telephone numbers and the IP addresses customers used. The vault backup kept some fields unencrypted, most importantly website URLs, while usernames, passwords, secure notes and form-filled data were encrypted with 256-bit AES under a key derived from each user's master password, which LastPass never stores. Other backups were taken too. LastPass's March 2023 update lists system configuration data, API secrets, third-party integration secrets, and a backup of its MFA and federation database containing authenticator seeds, phone numbers used for MFA backup and a split-knowledge key for federated business customers; the key that decrypted that backup was among the stolen secrets. Anything an attacker could decrypt had to be treated as exposed and rotated. Unencrypted URLs mattered. A list of the sites in each vault lets an attacker choose whose vault is worth the cost of cracking, for example vaults that list cryptocurrency exchanges or corporate administration portals. Metadata that looks harmless on its own can rank targets for an offline attack. ## Why the iteration count decided the damage A stolen vault can be attacked offline at the attacker's pace: guess a master password, derive the key with PBKDF2, try to decrypt. The cost of each guess is proportional to the iteration count, so a vault at 5,000 iterations is 120 times cheaper to attack than one at 600,000, and a vault at 1 iteration costs almost nothing per guess. A long random master password still holds; a short or reused one does not, whatever the iteration count. Wladimir Palant documented LastPass's history: a default of 1 iteration, raised to 500 in 2012, 5,000 in 2013 and 100,100 in 2018. The 2018 increase applied to new accounts, and the migration of existing accounts was never completed, so users reported accounts still at 5,000, 500 or 1 after the breach. OWASP raised its PBKDF2-HMAC-SHA256 recommendation to 600,000 iterations in January 2023, and LastPass now uses at least 600,000 for new accounts and for users who update their setting. The general rule applies to every stored verifier or derived key: a parameter change protects only the records it reaches. Upgrade each record at its next successful login or unlock, and handle dormant accounts explicitly, as the password storage guide at /domains/identity-crypto/authentication/password-storage/ describes. The query below finds the accounts still below the floor. ```sql -- Accounts whose key derivation is below today's floor (OWASP: PBKDF2-HMAC-SHA256, -- 600,000 iterations). Upgrade at the next unlock; for accounts that never log in, -- notify the owner and plan a forced reset or retirement. SELECT kdf, kdf_iterations, count(*) AS accounts, max(last_login) AS latest_login FROM vault_accounts WHERE kdf = 'pbkdf2-sha256' AND kdf_iterations < 600000 GROUP BY kdf, kdf_iterations ORDER BY kdf_iterations; ``` ## What followed In September 2023 Brian Krebs reported research by Taylor Monahan and others linking a series of cryptocurrency thefts, more than 150 victims and over $35 million, to seed phrases that victims had stored in LastPass. In March 2025 he reported a US court filing about the seizure of about $24 million from a $150 million theft on 30 January 2024. It says the thieves used a password stored in the victim's password manager account, stolen in the 2022 breach, which fits the researchers' view that the vaults were being cracked. On 11 December 2025 the UK Information Commissioner's Office announced a £1.2 million fine on LastPass UK Ltd, finding that it had not put sufficiently robust technical and security measures in place, and that the breach affected up to 1.6 million UK users. The ICO also said it had seen no evidence that customer passwords had been decrypted, because of the zero-knowledge design. LastPass's own remediation, from its March 2023 update, included rebuilding the development environment, rotating secrets and certificates, changing privileged access controls and expanding encryption across application and backup infrastructure. ## Lessons for teams that hold secrets - Treat backups and their decryption keys as production data. Keep the keys in a KMS or HSM with a separate role, logged use and, for keys that open everything, approval by more than one person, never in one engineer's vault or laptop. - Let privileged access to production come only from managed, monitored devices, with phishing-resistant MFA and short sessions. A home computer running unpatched media software must not be able to reach the keys to every customer's data. - Make key-derivation and password-hash upgrades reach existing records, and decide what happens to accounts that never log in. - Encrypt metadata that helps an attacker choose targets, such as the URLs stored next to encrypted secrets. - When an incident exposes internal secrets, rotate all of them, including MFA seeds and integration keys; the leaked-secret runbook at /domains/identity-crypto/secrets/leaked-secret-response/ gives the order. - Design for offline attack: memory-hard key derivation such as Argon2id, a minimum master-password length and blocklist checks, so a copied ciphertext is expensive to attack. ## Guided practice You run a service that stores client-side encrypted vaults, and a backup has been copied. Work out which users are in real danger and write the response. Compute the numbers yourself before reading the worked answers. ### Supplied material ```text Assumption for the exercise: the attacker's hardware computes 1.2 x 10^10 PBKDF2-HMAC-SHA256 iterations per second. Account A: 1 iteration; master password from a leaked list of 10^9 candidates; vault URLs include two crypto exchanges. Account B: 5,000 iterations; master password from the same list. Account C: 100,100 iterations; master password from the same list. Account D: 600,000 iterations; master password of four random words from a 7,776-word list (7,776^4 = 3.66 x 10^15). Account E: 100,100 iterations; last login 2019; vault contains an AWS access key and a database password. Backup also held: unencrypted URLs for every vault; an encrypted MFA-seed backup whose key was stored next to it. ``` ### 1. Compute the worst-case cracking times For A, B, C and D, compute the time to try every candidate: candidates x iterations / iterations per second. Worked answer: A: 10^9 / 1.2 x 10^10 = about 0.08 seconds. B: 10^9 x 5,000 / 1.2 x 10^10 = about 417 seconds, roughly 7 minutes. C: about 8,342 seconds, roughly 2.3 hours. D: 3.66 x 10^15 x 600,000 / 1.2 x 10^10 = about 1.8 x 10^11 seconds, roughly 5,800 years. ### 2. Rank who is in danger Use the numbers and the unencrypted URLs to decide whose secrets an attacker will reach first. Worked answer: A, B and C are effectively exposed: any password from a leaked list falls within hours even at 100,100 iterations, and A's crypto-exchange URLs make it a first target. D is safe on these assumptions because the password has about 51.7 bits of entropy, not because of the iteration count alone. The iteration count multiplies the work; it cannot rescue a guessable password. ### 3. Decide what to rotate Write the actions for account E and for the MFA-seed backup. Worked answer: E's AWS key and database password must be rotated at their issuers now, whatever the vault's strength, and the owner told; a dormant account means nobody else will do it. The MFA seeds are exposed because their key sat next to them: re-enroll every authenticator from that backup and treat the seeds as known to the attacker. ### 4. Write the upgrade policy Write the rule that would have prevented accounts A to C existing in 2022. Worked answer: Every account is re-derived to the current floor (for example 600,000 PBKDF2-HMAC-SHA256 iterations or Argon2id) at its next unlock, a scheduled job reports accounts still below the floor, and accounts that stay below it after a deadline are notified and then locked or retired. New master passwords must meet a minimum length and blocklist check. ### 5. Fix the key custody Describe where the backup and MFA-seed keys should have lived. Worked answer: In a KMS or HSM, usable only through a separate role from managed devices, with every use logged and alerted, and with the MFA-seed backup key stored apart from the backup itself; no engineer's personal vault should hold them. Deliverable: A table of the five accounts with cracking time, risk and action, a KDF upgrade policy of three to five rules, and a one-paragraph key-custody design. Scope: The guessing rate is an assumption for the exercise, not a benchmark of any hardware, and real attackers order guesses by likelihood rather than trying every candidate. LastPass's actual account mix and parameters are not known publicly. Articles and teaching material: CC BY 4.0. Original executable code: MIT. Attribution: Software Security. ## Sources - [LastPass: notice of security incident (25 August 2022, updated 22 December 2022)](https://blog.lastpass.com/posts/notice-of-recent-security-incident) - [LastPass: security incident update and recommended actions (1 March 2023)](https://blog.lastpass.com/posts/security-incident-update-recommended-actions) - [LastPass Trust Center FAQ: PBKDF2 iterations](https://www.lastpass.com/trust-center/faq) - [Information Commissioner's Office: password manager provider fined £1.2m (11 December 2025)](https://ico.org.uk/about-the-ico/media-centre/news-and-blogs/2025/12/password-manager-provider-fined/) - [Information Commissioner's Office: penalty notice to LastPass UK Ltd (20 November 2025)](https://ico.org.uk/action-weve-taken/enforcement/2025/11/lastpass-uk-ltd/) - [Sophos: LastPass, the crooks used a keylogger to crack a corporate password vault](https://www.sophos.com/en-us/blog/lastpass-the-crooks-used-a-keylogger-to-crack-a-corporatre-password-vault) - [TechTarget: LastPass breach tied to hack of engineer's home computer (28 February 2023)](https://www.techtarget.com/cybersecurity/news/365532032/LastPass-breach-tied-to-hack-of-engineers-home-computer) - [BleepingComputer: CISA warns of actively exploited Plex bug after LastPass breach](https://www.bleepingcomputer.com/news/security/cisa-warns-of-actively-exploited-plex-bug-after-lastpass-breach/) - [Wladimir Palant: LastPass breach, the significance of these password iterations](https://palant.info/2022/12/28/lastpass-breach-the-significance-of-these-password-iterations/). 28 December 2022. - [Krebs on Security: experts fear crooks are cracking keys stolen in LastPass breach (September 2023)](https://krebsonsecurity.com/2023/09/experts-fear-crooks-are-cracking-keys-stolen-in-lastpass-breach/) - [Krebs on Security: feds link $150M cyberheist to 2022 LastPass hacks (March 2025)](https://krebsonsecurity.com/2025/03/feds-link-150m-cyberheist-to-2022-lastpass-hacks/) - [OWASP Password Storage Cheat Sheet: PBKDF2 iterations](https://cheatsheetseries.owasp.org/cheatsheets/Password_Storage_Cheat_Sheet.html)