LastPass parent GoTo confirms hackers stole encrypted backups, an encryption key for some data, billing info, and more, in a breach first disclosed last year
GoTo (formerly LogMeIn) is warning customers that threat actors who breached its development environment in November 2022 stole …
Context & Ripple Effects
This confirmation closes a loop that opened with LastPass's August 2022 source code theft and escalated when hackers used keys stolen from an employee to lift a backup of users' encrypted and unencrypted vault data in December. What GoTo is adding today is scope: the same development-environment intrusion also yielded encrypted backups, an encryption key covering some data, and customer billing information.
The disclosure matters because it widens the blast radius beyond password vaults to GoTo's own customer base, and because it precedes the fuller technical accounting LastPass gave in February about a keylogger planted on a DevOps engineer's machine. It also lands on a parent already reshaping itself — GoTo had been shedding units and cutting jobs before eventually spinning LastPass off in 2024.
First-order effects
- GoTo and LastPass customers whose billing information was taken face immediate fraud and phishing exposure, forcing both companies into expanded notifications and support burden on top of the vault-data warnings already issued.
- The admission that an encryption key for some data was stolen undercuts the zero-knowledge assurance LastPass gave after the earlier vault-backup disclosure, at least for the affected subset.
Second-order effects
- LastPass is pushed into company-wide security changes following the breach, while its standing as an acquirable asset is degraded — the 2024 separation from GoTo lands on a brand carrying this disclosure history.
- Every incremental confirmation reopens the incident publicly, giving rival password managers a recurring trust argument against centralized vault custody without any new marketing spend of their own.
Third-order effects
- If the pattern holds — initial narrow disclosure, then successive expansions of scope — buyers of credential-management services will increasingly price vendor breach history and demand architectures where encrypted vaults are useless without customer-held keys.
- Regulators and enterprise procurement teams get a case study in how multi-month, multi-stage intrusions strain the standard single-disclosure breach model, pressuring disclosure practices across SaaS vendors.
The trend: Password-manager breaches are shifting from one-time incidents to rolling disclosures that steadily transfer trust from centralized vault vendors toward customer-controlled key architectures.