LastPass Breach 2022: How Stolen DevOps Secrets Unlocked Every Customer Vault Backup

In 2022, an attacker broke into LastPass twice, and the second intrusion took backups of customer vault data from the company's cloud storage. The route to those backups ran through secrets rather than systems: source code and scripts from a first intrusion pointed to where the keys lived, and a keylogger on a senior DevOps engineer's home computer captured the master password to the corporate vault that held them. With AWS access keys and decryption keys in hand, the attacker could read backups that included the vaults of every customer and the company's MFA and federation database. The UK Information Commissioner's Office fined LastPass UK Ltd £1.2 million in December 2025, and US investigators have since linked large cryptocurrency thefts to the stolen vaults.

At a glance

What happened

LastPass says the attack came in two linked incidents. In the first, in August 2022, the attacker took 14 of the company's 200 software repositories, along with internal scripts that contained LastPass secrets and certificates, and internal technical documentation. The ICO describes this stage as the compromise of an employee's corporate laptop, giving access to the development environment and to encrypted company credentials that could unlock the backup database if decrypted.

In the second incident, the attacker used what had been learned to go after the keys themselves. LastPass says: "The threat actor targeted a senior DevOps engineer by exploiting vulnerable third-party software". According to the company's later detail, reported by Sophos, this meant attacking the engineer's home computer through "a vulnerable third-party media software package", which allowed remote code execution and the installation of keylogger malware. The attacker captured the engineer's master password "as it was entered, after the employee authenticated with MFA" and got into the engineer's LastPass corporate vault. The Hacker News later reported that the software was Plex Media Server, and in March 2023 the US Cybersecurity and Infrastructure Security Agency warned that the Plex flaw, CVE-2020-5741, was being actively exploited. Plex had fixed it in May 2020.

The ICO adds two identity details that matter. MFA was circumvented using a trusted device cookie, and the engineer's personal and business vaults were linked through a single master password. From the vault, the attacker took AWS access keys and decryption keys. BleepingComputer reported that only four DevOps engineers held the decryption keys needed to access the AWS storage, and that the attacker exported the engineer's corporate vault entries and shared folder contents.

Between 12 August and 26 October 2022, according to BleepingComputer, the attacker used these valid credentials to access and steal data from LastPass's cloud storage servers, which made the activity difficult to detect. The data taken included configuration data, API secrets, third-party integration secrets, backups of customer vault data and backups of the LastPass MFA/Federation Database. LastPass says it has "not seen any threat-actor activity since October 26, 2022."

When LastPass disclosed the vault theft on 22 December 2022, chief executive Karim Toubba said the attacker "took a copy of a backup of customer vault data by using cloud storage keys stolen from a LastPass employee." Sensitive vault fields were encrypted under the company's zero knowledge model, but LastPass says URLs, file paths to installed LastPass Windows or macOS software and certain use cases involving email addresses were not. TechCrunch reported that the backup also held customer names, email addresses, phone numbers and some billing details. Toubba warned that attackers "may attempt to use brute force to guess your master password and decrypt the copies of vault data they took."

That warning turned out to be the long tail of the breach. In March 2025, the US Justice Department filed a civil forfeiture complaint to seize $23,604,815.09 in cryptocurrency, according to BleepingComputer, or about $24 million by KrebsOnSecurity's figure. The complaint says FBI and Secret Service investigators believe the same attackers behind the password manager breaches used a stolen password held in the victim's online password manager account to steal $150 million from Ripple co-founder Chris Larsen, on 30 January 2024 according to KrebsOnSecurity (BleepingComputer gives 31 January). The complaint does not name LastPass, but KrebsOnSecurity reported the link, and BleepingComputer noted that Larsen had stored private keys in LastPass, which was breached in August and November 2022. LastPass has said its law enforcement partners had not made it aware of "any conclusive evidence that connects any crypto thefts to our incident." In December 2025, TRM Labs said it had traced more than $35 million in stolen cryptocurrency to the breach, including about $7 million in a wave it identified in September 2025, and said attackers were still cracking weak master passwords years later.

Timeline

How it happened: the identity attack path

1. Secrets in code and scripts. The first intrusion took repositories and internal scripts that contained LastPass secrets and certificates, plus documentation, and encrypted credentials for the backup database. This told the attacker where the valuable machine credentials were kept.
2. A person as the path to the keys. Only four engineers could reach the backup keys, so the attacker targeted one of them, at home, where corporate controls were weakest.
3. An unpatched personal device. A media server on the engineer's home computer had a flaw that had been fixed in 2020. Exploiting it gave remote code execution and a keylogger.
4. MFA that did not help. The master password was captured after MFA had been completed, and the ICO says MFA was bypassed with a trusted device cookie.
5. One password, two vaults. The engineer's personal and business vaults were linked by a single master password, so access to one gave the attacker the corporate vault.
6. Long-lived cloud keys in a vault. The vault held AWS access keys and decryption keys. Used from outside, they gave the attacker read access to cloud backup storage and the means to decrypt the backups that were encrypted with company keys.
7. Two and a half months of use. The keys were used for reconnaissance and exfiltration from 12 August to 26 October 2022.

Impact

• Customer data: backups of customer vault data, with encrypted credentials and notes but unencrypted URLs, plus customer names, email addresses, phone numbers and some billing details.
• Business customers: backups of the MFA/Federation Database, which LastPass says contained copies of LastPass Authenticator seeds.
• UK users: up to 1.6 million, according to the ICO.
• Regulatory: a £1.2 million ICO fine in December 2025.
• Downstream theft: a $150 million theft in January 2024 linked by US investigators, about $23.6 million seized in March 2025, and more than $35 million in thefts traced by TRM Labs.

What this means for NHI governance

LastPass is often told as a story about a keylogger and a home computer, but the asset the attacker wanted was a handful of machine credentials. AWS access keys and decryption keys are non-human identities: they authenticate to cloud services and unlock data without a person in the loop. At LastPass they were long-lived, stored as items in a human's password vault, and usable from anywhere. Once the attacker held them, the cloud platform had no way to tell a legitimate backup job from theft.

Three governance lessons follow. First, a secret stored in a person's vault inherits every weakness of that person's endpoint and login. The ICO's findings on the trusted device cookie and the linked personal vault show how quickly human controls fall away. Second, the keys to the most valuable data should not be static credentials that can be copied and replayed. Short-lived credentials issued to a workload, bound to a known environment and checked on every use, would have made the stolen material far less useful. Third, the first incident mattered because it took secrets and certificates embedded in scripts. Secrets in code turn a source code leak into a map of the estate.

The same pattern of stolen cloud keys leading to bulk data theft appears across our timeline, from the Snowflake breach to TruffleNet.

Recommendations

• Move backup and data access keys out of human vaults. Issue short-lived credentials to the workloads that need them, using federation and roles rather than static access keys. Our Cloud Workload Identity Guide explains the options.
• Separate data access from decryption. Keep encryption keys in a key management service with policies that stop a single identity from both downloading and decrypting backups.
• Treat the few people with key access as privileged users. Require managed devices, phishing-resistant MFA and just-in-time elevation, as covered in our Privileged Access Management Guide.
• Remove secrets from code and scripts. Scan repositories and replace embedded secrets and certificates with runtime retrieval. See the Secret Sprawl Challenge.
• Rotate after any source or vault compromise. Assume every credential in stolen code or a compromised vault is exposed, and rotate it at once. Our guide to NHI rotation challenges covers how.
• Alert on cloud key use from unusual places. Backup keys used from a new network, or used to enumerate storage, should raise an immediate alert.

Frequently asked questions

How was LastPass hacked in 2022?

An attacker used source code and secrets from a first intrusion to target a senior DevOps engineer, installed a keylogger on the engineer's home computer through vulnerable media software, captured the master password to a corporate vault and used the AWS access keys and decryption keys inside it to copy cloud backups.

Were LastPass customer passwords stolen?

Backups of customer vaults were stolen. Passwords inside them were encrypted with each customer's master password, which LastPass does not hold, but URLs and some customer details were not encrypted, and vaults protected by weak master passwords can be cracked offline.

Why is the LastPass breach a non-human identity breach?

The data was taken with machine credentials: AWS access keys and decryption keys for the backup storage. The attack on the engineer was the route to those keys, which were long-lived and stored in a person's vault.

Related NHI Mgmt Group resources

Snowflake breach · CircleCI breach · Static vs Dynamic Secrets · Top 10 NHI Issues · NHI breaches

How NHI Mgmt Group can help

Securing Non-Human Identities (NHIs), including AI agents, is becoming increasingly crucial as attackers target cloud access keys, encryption keys, API keys, tokens and secrets. Our NHI Foundation Level Training Course gives teams the practical grounding to find, govern and protect these identities.

References

• LastPass: Security Incident Update and Recommended Actions (March 2023)
• ICO: Password manager provider fined £1.2m for failing to protect users' data (11 December 2025)
• TechCrunch: LastPass says hackers stole customers' password vaults (22 December 2022)
• BleepingComputer: LastPass: DevOps engineer hacked to steal password vault data in 2022 breach (27 February 2023)
• Sophos: LastPass, keylogger on home PC led to cracked corporate password vault (27 February 2023)
• The Hacker News: LastPass Hack, Engineer's Failure to Update Plex Software Led to Massive Data Breach (7 March 2023)
• BleepingComputer: CISA warns of actively exploited Plex bug after LastPass breach (11 March 2023)
• Almost Secure (Wladimir Palant): LastPass breach update, the few additional bits of information (28 February 2023)
• KrebsOnSecurity: Feds Link $150M Cyberheist to 2022 LastPass Hacks (7 March 2025)
• BleepingComputer: US seizes $23 million in crypto linked to LastPass breaches (7 March 2025)
• TRM Labs: TRM Traces Stolen Crypto from 2022 LastPass Breach (24 December 2025)