LastPass Master Password Leak: What Users Need to Know

Yes, in December 2022, LastPass disclosed that attackers had copied encrypted vault data, including the password hashes of master passwords, during a security incident. This means your master password could be at risk if it was weak or reused, but the encryption means a strong, unique master password is likely still safe. Here’s what happened, what it means for you, and how to protect your accounts.

Background: The LastPass Breaches

LastPass experienced two related security incidents in 2022. In August, attackers gained access to the company’s development environment, and in November/December, they used information from that first breach to target a cloud storage service where LastPass stored encrypted backups of customer vault data. The attackers copied encrypted vault data and also exfiltrated some personal information, such as email addresses, phone numbers, and IP addresses.

The crucial detail is that the vaults are protected by a master password that is never sent to LastPass’s servers. The company uses a process called “key derivation” (specifically PBKDF2) to turn your master password into an encryption key. The attackers obtained the derived hashes, not the plaintext master passwords. However, they also have the encrypted vaults, which means they can attempt offline brute-force attacks to guess weak master passwords.

How LastPass Encrypts Your Data

LastPass uses a zero-knowledge model: your master password is used to generate a key that encrypts your vault locally on your device. The encrypted vault is then synced to LastPass’s servers. The company never sees your master password or the decrypted vault contents.

When you create a master password, LastPass runs it through a key derivation function (PBKDF2) with a salt and a high iteration count (default 100,100 iterations). This produces a hash that is stored on their servers. During login, your password is hashed and compared. The attackers stole these hashes and the encrypted vaults.

Even with the hash, an attacker cannot directly reverse it to get your password. They must guess passwords and run the same derivation, which is computationally expensive. However, if your master password is short, common, or reused from another site, it becomes feasible to crack.

What the Attackers Actually Got

According to LastPass’s public statements, the attackers copied:

• Encrypted vault data (including usernames, passwords, notes, and other stored items)
• Master password hashes (derived via PBKDF2)
• User email addresses and some personal information
• Encryption keys for the cloud storage (but not the vault encryption keys)

Importantly, the attackers did not get your master password in plaintext, nor the decrypted vault. But they have everything needed to attempt to crack weak master passwords offline.

Are You at Risk? Assessing Your Exposure

Your risk depends largely on the strength and uniqueness of your master password. Consider these scenarios:

• Strong, unique master password (e.g., 12+ random characters): Extremely unlikely to be cracked. The PBKDF2 hashing makes brute-force attacks impractical.
• Moderate password (e.g., 8-10 characters, not reused): Potentially at risk if the attacker invests significant computing power. Changing it is advisable.
• Weak or reused password (e.g., a common phrase or one used on other sites): High risk. The attackers may try dictionary attacks or use passwords leaked from other breaches. You should change it immediately.

If you used your master password anywhere else, treat that password as compromised and change it on those sites as well.

What You Should Do Now

Even if you have a strong password, it’s prudent to take the following steps:

1. Change your master password immediately. Use a long, random passphrase that you have never used elsewhere.
2. Enable two-factor authentication (2FA) on your LastPass account if you haven’t already. This adds a barrier even if your master password is compromised.
3. Rotate important passwords stored in your vault, especially for email, banking, and other critical accounts. Since the encrypted vaults are in the hands of attackers, they may eventually be decrypted if your master password is weak.
4. Check for suspicious activity on your accounts, especially phishing emails targeting you (attackers have your email address).
5. Consider switching to another password manager if you prefer not to stay with LastPass. Many reputable alternatives exist, but ensure you export your data securely first.

Common Misconceptions

One common misconception is that “your passwords were leaked in plaintext.” That is not true. The vaults are encrypted, and without your master password, they are unreadable. However, the attackers can attempt to guess your master password offline, so the strength of that password is the deciding factor.

Another misconception is that changing your master password “fixes” the risk. It does, but only if you also consider that the old encrypted vaults are still in the attackers’ hands. If your old master password was weak, they might crack it and access the old vault data. That’s why rotating important passwords is recommended.

Frequently Asked Questions

Should I stop using LastPass?

That’s a personal decision. If you have a strong, unique master password and have enabled 2FA, your data is likely safe. However, if you are uncomfortable with the company’s handling of the incident or prefer a different model, you can migrate to another password manager. Just be sure to export your data and delete your LastPass account properly.

Can the attackers decrypt my vault without my master password?

No. The vault is encrypted with a key derived from your master password (using PBKDF2). Without that password, the encryption cannot be broken with current technology. The only way is to guess the password and try to decrypt, which is what makes weak passwords dangerous.

How do I know if my master password was weak?

If your master password is a common word, a short phrase, or appears in known password lists, it’s weak. You can check if it’s been exposed in other breaches using services like Have I Been Pwned (but do not enter your actual LastPass master password there—enter a variation or just assume it’s at risk if it’s reused).

What is PBKDF2 and why does it matter?

PBKDF2 is a key derivation function that repeatedly hashes your password (thousands of times) to make brute-force attacks slower. LastPass uses it with 100,100 iterations. The higher the iteration count, the harder it is to crack. You can increase this in your LastPass settings for extra security.

Is it safe to keep using LastPass after changing my password?

Yes, if you change to a strong, unique master password and enable 2FA, your new vault data is protected. The old encrypted vaults are still out there, but without your old password, they remain unreadable. If you reused the old password elsewhere, change those too.

What should I do if I reused my LastPass master password on other sites?

Change it immediately on those sites, especially for email, banking, and social media. Since attackers have your email address and the password hash, they may try credential stuffing—using the same password on other services. Enable 2FA wherever possible.

Related

• Midnight Blizzard Breach: Why Identity Trust Failed
• RAR ZIP Cannot Be Extracted? Fixes That Work
• 750 kW & Megawatt EV Charging: Can Today’s Cars Use It?