Could You Be Affected by the LastPass Data Breach?

LastPass is a password management service that allows users to store and manage login details for websites and apps in one encrypted digital vault. It is used by millions of individuals and businesses worldwide. 

Attackers first gained access to internal systems via an employee’s device, then later used that information to access cloud-based backup data. This led to unauthorised access to customer information, including encrypted vault data. 

The UK’s data protection regulator estimates that up to 1.6 million UK users were affected by the breach. 

The attackers accessed a mix of encrypted and unencrypted data, including: 

• Encrypted password vault data (such as usernames and passwords stored in vaults)
• Website URLs linked to stored accounts
• Some personal information, such as email addresses, IP addresses and phone numbers 

LastPass and regulators have said there is no evidence that passwords were decrypted, but stolen encrypted data can still carry long-term risks. 

The Information Commissioner’s Office (ICO) fined LastPass £1.2 million after finding it had failed to put sufficiently robust technical and organisational security measures in place. The regulator said users had a right to expect stronger protection for such sensitive data. 

Not necessarily. Security experts and regulators continue to recommend password managers as a safer alternative to reusing passwords across multiple sites. However, the breach highlights that password managers are not risk-free and that strong governance, staff security practices and supplier controls are critical. 

If you were a UK LastPass user during the period affected by the breach and are concerned about how your data was handled, you can register your interest to stay informed about potential next steps and options that may become available with our trusted legal partners. 

We are not a law firm. Our role is to keep people informed about potential group actions if one of our regulated UK partner law firms is able to take this claim forward.  

By registering, you’ll stay up to date with any developments — from investigations to possible legal action.  

No. Registering simply means you’ll receive updates. If a law firm later takes on the case, you’ll be given the option to learn more about the process and any potential costs before deciding whether to take part. 

A group action claim allows people affected by the same issue to take action together. This strength in numbers helps stand up to big organisations. Join the Claim helps connect people with law firms so these actions have a real impact.