LastPass
the only confirmed large-scale vault breach in this category, disclosed in unusual detail by the company that suffered it.
ranked last on the record rather than the technology: customer vault backups and unencrypted urls left the building in 2022, and no amount of subsequent hardening undoes that.
the sequence, from lastpass's own disclosures. on 25 august 2022 it reported that a compromised developer account had exposed portions of source code and technical information, stating there was no evidence customer data or encrypted vaults were involved. on 22 december it disclosed that the intruder had used that access to reach a third-party cloud storage service and exfiltrate backups containing customer account metadata in the clear — names, billing addresses, email addresses, phone numbers — along with vault copies in which website urls were unencrypted and usernames, passwords and notes remained aes-256 encrypted behind each user's master password.
the unencrypted urls are the part that still matters. even with passwords intact, an attacker holding a vault knows precisely which services a person uses, which is a targeting list. a separate 2015 incident exposed email addresses, password reminders, per-user salts and authentication hashes, and prompted a mass master-password reset.
the description above is ours, condensed from the ranking. pricing moves — check it on the vendor's own page before you rely on it.
- category
- password managers
- pricing
- unverified
- website
- lastpass.com
ranked last on the record rather than the technology: customer vault backups and unencrypted urls left the building in 2022, and no amount of subsequent hardening undoes that.
we researched this category against vendors' own pricing pages and licence files. that is where this line comes from — not from the vendor, and not from anything they paid for.