LastPass separates from GoTo, which announced the spinoff in December 2021, six years after buying LastPass; the service suffered high profile hacks in 2022
It's been over a year and a half since LastPass suffered back-to-back high-profile hacks, and the company now says it has separated from its parent company, GoTo.
Context & Ripple Effects
The separation completes the spinoff first outlined in 2021, ending the ownership structure created when LogMeIn acquired LastPass.
It arrives after a sequence of 2022 incidents, including unauthorized access tied to shared third-party cloud storage and later disclosure that backup vault data had been taken. The corporate split therefore lands alongside an unresolved trust and security-reputation challenge.
First-order effects
- LastPass becomes separate from GoTo, giving the password-management business its own corporate identity after the announced spinoff.
- GoTo no longer owns LastPass, while LastPass must address customers and partners as an independent company following the breach disclosures.
Second-order effects
- The split makes LastPass's security posture and recovery efforts more directly attributable to its own leadership and brand, rather than to its former parent.
- Enterprise customers evaluating password-management providers may treat the separation and the earlier incidents as connected due-diligence questions, increasing pressure for clear accountability.
Third-order effects
- If cybersecurity products increasingly separate from broader software groups, standalone security brands may face greater demand to demonstrate independent governance and resilience after incidents.
- The case underscores how security breaches can reshape not only product trust but also the corporate boundaries through which customers assess responsibility.
The trend: Cybersecurity vendors are being judged as much on accountable governance after incidents as on the security tools they sell.