LastPass Settles 2022 Breach Lawsuit with Up to $24.45M Payout

Password manager company LastPass has agreed to a proposed class‑action settlement worth up to $24.45 million. The deal aims to resolve claims related to the 2022 data breach that exposed encrypted customer vaults and resulted in significant cryptocurrency thefts.

Filed on December 23, 2025, in the U.S. District Court for the District of Massachusetts, the settlement includes payments for general claims and a dedicated fund for losses related to cryptocurrency. LastPass denies wrongdoing but agreed to settle without admitting liability.

How the Breach Happened

The breach began in August 2022. Hackers compromised a developer’s environment and stole source code. Using that access, they later entered cloud storage backups containing customer password vaults.

The vaults used 256‑bit AES encryption. LastPass applied its “zero‑knowledge” system. The company never stored master passwords. Hackers could not access those passwords directly.

However, stolen data included URLs, metadata, and encrypted credentials. Security experts explained that strong master passwords are essential for keeping vaults safe. But weak or reused passwords were vulnerable.

Hackers used brute‑force attacks and targeted weak passwords to decrypt vaults offline. This gave them access to sensitive information, including cryptocurrency wallet seed phrases and private keys.

Losses and Legal Action

The thefts were significant. Independent researchers, including ZachXBT, linked the stolen data to more than $438 million in cryptocurrency losses by mid‑2025.

Victims included Ripple co‑founder Chris Larsen, who lost $150 million in early 2024. Waves of attacks in late 2024 drained millions more from other users.

The class‑action lawsuit combined multiple claims. Plaintiffs argued that LastPass failed to secure access keys and did not enforce strong master password practices.

The proposed settlement sets aside at least $8.2 million for statutory payments and reimbursements. An additional $16.25 million is reserved for documented cryptocurrency losses directly tied to the breach.

Separately, regulators also acted. In November 2025, the UK’s Information Commissioner’s Office fined LastPass £1.2 million (about $1.6 million). The ICO said 1.6 million UK users were affected.

It found no evidence of mass password decryption but criticized weak safeguards. A Canadian class‑action settlement worth about US$3 million is also moving forward in early 2026.

What Comes Next

The U.S. settlement still requires preliminary court approval. If granted, millions of class members will receive notice on how to file claims. General reimbursements will cover out‑of‑pocket losses and statutory damages. The crypto fund will reimburse verified thefts linked to compromised vaults.

Industry experts say the case highlights risks of centralized password managers. Even encrypted data can cause harm if the master password is weak. Analysts recommend hardware wallets and self‑custody for digital assets.

As digital holdings grow, breaches like this show the tension between convenience and security. Affected users are advised to watch for official court notices once the settlement advances.