LastPass

The 2022 breach of LastPass vault backups reshaped coverage, with later stories tracking its security overhaul, spinoff from GoTo, and fresh third-party data exposure.

Who they are

LastPass is a password-management service whose coverage centers on the security of customer credentials and vault data. It appears alongside rival 1Password, platform owner Apple, and former parent GoTo, reflecting its position in both the consumer password-manager market and broader enterprise access-management discussions.

The recent arc

The dominant recent phase began with the 2022 breaches and their disclosures: LastPass said attackers obtained a backup copy containing encrypted and unencrypted vault data, and later attributed the vault-data theft to a keylogger installed on a DevOps engineer’s computer through a third-party software flaw. Coverage in 2023 and 2024 then followed remediation, including a 12-character master-password requirement and warnings about a fraudulent “LassPass” app in Apple’s App Store designed to phish credentials.

In 2024, the story widened beyond breach response. LastPass completed its separation from GoTo, while Apple’s WWDC features were described as encroaching on capabilities associated with LastPass and 1Password. By February 2026, CEO Karim Toubba was emphasizing company-wide changes after the breach and new shadow-SaaS controls; June coverage returned to security exposure when LastPass notified customers that personal information and support records had been stolen in a hack at research firm Klue.

The tension

Coverage repeatedly tests whether LastPass can restore trust in a product entrusted with users’ most sensitive credentials after the 2022 incidents, while defending against adjacent threats such as app impersonation and third-party compromise. That reputational challenge coincides with competitive and platform pressure: 1Password is the closest recurring peer, and Apple’s expansion of native password-management functionality potentially reduces the distinctiveness of independent password managers.

Why it matters

LastPass’s trajectory is a useful test of whether a security product can turn a major breach into a more credible operational and product posture. Its push into controls for shadow SaaS suggests an effort to broaden beyond password storage, but continuing incidents involving external parties could keep trust and supply-chain exposure at the center of its market position; Apple’s platform moves add uncertainty about how much standalone password managers can retain control of the user experience.

Related: GoTo · 1Password · Apple · LastPass says hackers stole a backup copy of users' encrypted and unen · LastPass warns it was hacked, says secure vault storing user passwords