LastPass's Vaults Walked Out Through a Keylogger on One Engineer's Personal Device, and Passkeys Retired the Strong-Password Advice

The attacker never had to crack a single customer’s master password to get the vaults. One engineer’s master password, typed on a personal device, was enough.

The UK’s Information Commissioner laid it out on December 11, 2025. A hacker first “compromised a LastPass employee’s corporate laptop” and got into the development environment. Then the hacker reached a senior employee’s personal device “via a known vulnerability in a third-party streaming service,” and a keylogger captured that employee’s master password. From there it was the backup database. LastPass’s own March 2023 update puts it as “The threat actor targeted a senior DevOps engineer by exploiting vulnerable third-party software.”

What left the building, per LastPass’s December 2022 notice: a backup of customer vault data. Usernames, passwords and notes inside were encrypted with 256-bit AES. The website URLs were not. So the thief walked off with an encrypted safe for each customer, with a list of every lock it opens taped to the outside.

The ICO’s penalty came to £1,228,283, issued November 20, 2025, over data on about 1.6 million UK customers. The regulator found no evidence the vault passwords were decrypted. “Password managers are a safe and effective tool for businesses and the public to manage their numerous login details,” said John Edwards, the UK Information Commissioner, in the same release.

Whether anyone has cracked vaults since is the unresolved part. In a seizure complaint over a $150 million crypto theft on January 30, 2024, a U.S. Secret Service agent wrote that it came from “the same attackers behind the above-described commercial online password manager attack,” Brian Krebs reported in March 2025. LastPass told him it had seen no definitive proof tying the thefts to its breach.

A passkey has no secret for a keylogger to catch: the site keeps a public key and your device keeps the private one. That’s the part of the 2022 story it answers. LastPass added passkey support on August 20, 2025, so the same vault that was copied now holds the thing meant to replace what was in it.

The weak spot moves with it. A passkey synced through a password manager is only as safe as the account that syncs it, and that account still opens with something a person types or taps. The streaming app on somebody’s personal device is still out there.

The open question is the one the Secret Service complaint raised and nobody has settled in public: how many of those 2022 vault copies have already been opened, and who finds out first.