LastPass customer vault backup theft via engineer credentials and trusted device cookie
In August 2022 an attacker compromised a LastPass employee's corporate laptop and took source code and encrypted credentials from the development environment, which LastPass disclosed on August 25, 2022. The attacker then targeted a senior engineer with access to decryption keys, used a vulnerability in third-party media software on his home computer to install a keylogger, captured his master password and bypassed MFA with a trusted device cookie. The AWS access key and decryption key in his vault let the attacker copy customer vault backups, disclosed in December 2022.
- Victim
- LastPass
- Industry
- Technology
- Country
- United States
- Intrusion began
- Aug 2022
- First disclosed
- Aug 25, 2022
- Actor
- Unattributed
- Initial access
- Stolen credentials
- Identity control that failed
- Credential storage
- MFA
- Present and bypassed
- Abused identity
- Human account
- Records affected
- Not disclosed
- Disclosed cost
- ICO fine of GBP 1.2 million (not converted).
The identity lesson
Keys that decrypt all customer backups should not sit in one person's password vault on a personal device; hardware-bound MFA and split custody of production keys would have broken the chain.
Regulatory and legal outcome
December 11, 2025: the UK ICO fined LastPass UK Ltd GBP 1.2 million under UK GDPR Articles 5(1)(f) and 32.
Go deeper on SWI
- Technique: Session cookie theft
- Technique: Static API key abuse
- Product involved: LastPass
Sources
- Password manager provider fined, Information Commissioner's Office, Dec 11, 2025
- LastPass hammered with £1.2M fine for 2022 breach fiasco, The Register, Dec 11, 2025
Record verified Oct 31, 2026 against the sources above. Corrections: contact us.
Related incidents
- Cloudflare Atlassian intrusion with credentials left unrotated after the Okta breach 2024 · Stolen credentials
- Okta customer support system breach and HAR-file session token theft 2023 · Stolen credentials
- GitHub repositories cloned with a compromised machine-account token 2023 · Stolen credentials
- GhostAction returns: hijacked GitHub accounts push secret-stealing workflows 2026 · Stolen credentials
Cite this record
SWI Community Team. (2026). LastPass customer vault backup theft via engineer credentials and trusted device cookie. Identity Breach Database, Start with Identity. https://startwithidentity.com/breaches/incidents/2022-lastpass-vault-backup-theft/
Part of the Identity Breach Database, free to reuse under CC BY 4.0. Analysis across every record: Identity Breach Report 2026.