LastPass 2022: How a Vault Dump Became Years of Pain for Users

The Dual Compromise

The LastPass incident of 2022 is actually two linked attacks that resulted in the theft of encrypted vaults for all users.

First phase (August 2022): an attacker compromises a LastPass developer's workstation and gains access to source code and internal technical information.

Second phase (October-November 2022): using information obtained during the first phase, the attacker targets one of four DevOps engineers who have access to the cloud infrastructure decryption keys. They exploit a vulnerability in Plex software installed on this engineer's personal computer to install a keylogger and obtain their credentials.

Result: the attacker accesses AWS S3 backups containing encrypted vaults for all LastPass users.

What Was Stolen

Unencrypted data: the URLs of websites stored in vaults were not encrypted. An attacker therefore knows which sites you use (banks, health services, social networks).

Encrypted data: usernames and passwords are encrypted with AES-256 using a key derived from the user's master password.

The problem: the vaults are now in the attacker's hands. They can attempt to crack master passwords offline, with no rate limiting.

Long-Term Impact

Unlike a standard password breach (where the affected service can force a change), LastPass vaults are static. The attacker has all the time needed to:

In 2023 and 2024, security researchers documented cryptocurrency thefts linked to compromised LastPass vaults. Victims used weak master passwords and stored crypto wallet seed phrases in LastPass.

Weaknesses Revealed

Encryption depended on the master password. If the master password is weak (short, reused, predictable), AES-256 encryption protects nothing. LastPass did not enforce strict minimum length for legacy accounts.

PBKDF2 iteration count was insufficient. For legacy accounts, the iteration count was 5,000, far below current recommendations (600,000+). This dramatically accelerates brute-force attacks.

URLs were not encrypted. This was a design choice prioritizing performance (vault search) over confidentiality.

Backup access was not sufficiently segmented. A single engineer with the right keys could access all backups.

Lessons

A password manager is a SPOF. All eggs are in one basket. The master password must be extremely strong (20+ characters, random).

Client-side encryption only protects if the key is strong. AES-256 with an 8-character password is a high-security lock with the key under the doormat.

Backups are targets. Cloud backups containing sensitive data must have access controls as strict as production systems.

Zero trust applies to engineers. The attack targeted an engineer's personal computer. Critical access should not depend on the security of a personal device.

The LastPass compromise highlights the importance of auditing the complete security chain. CleanIssue verifies that your secret storage and encryption mechanisms withstand this type of scenario.