A password manager breach does not automatically mean attackers can read every saved password. In the 2022 LastPass incident, attackers copied customer vault backups and exposed some unencrypted information, including website URLs; the UK regulator later said it found no evidence that encrypted passwords and other credentials were decrypted. In a different 2026 incident, Dashlane said attackers downloaded encrypted vaults belonging to fewer than 20 personal-plan customers. What was copied, what was readable, and what you should do depend on the incident.
What a password manager breach can expose
“Data was stolen” is not the same as “the attacker could read every item in it.” A password manager breach can involve several distinct layers:
As an Amazon Associate I earn from qualifying purchases.
- Account or provider data: Personal information, internal credentials, cloud backups, or other provider systems may be accessed.
- Readable vault information: Some fields or metadata may not receive the same encryption as passwords. Website URLs, for example, were visible to the threat actor in the LastPass case described by the UK Information Commissioner’s Office (ICO).
- Encrypted vault contents: Attackers may copy ciphertext without having the key needed to decrypt it. A copied vault can still be targeted for offline password guessing, so encryption does not make a weak or reused master password harmless.
- Decrypted credentials: This is a separate and more serious finding. In its December 2025 LastPass announcement, the ICO said it found no evidence that the attacker decrypted customers’ encrypted passwords and other credentials.
These distinctions matter: it would be wrong to say that nothing was exposed in the LastPass breach, and also wrong to say that all saved passwords were stolen in readable form.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
What happened in the LastPass breach
The 2022 LastPass incident was a linked sequence, not a single break-in. An initial compromise of part of the company’s development environment yielded internal information and credentials. A later compromise of a senior engineer’s personal computer enabled the attacker to obtain credentials and keys used to reach cloud backups. The ICO’s later investigation provides a regulator-reviewed account of the impact and security failures.
#1 Best Overall
- POWERFUL SECURITY KEY: The Security Key C NFC is the essential physical passkey for protecting your digital life from phishing attacks. It ensures only you can access your accounts.
- WORKS WITH 1000+ ACCOUNTS: Compatible with Google, Microsoft, and Apple. A single Security Key C NFC secures 100 of your favorite accounts, including email, password managers, and more.
- FAST & CONVENIENT LOGIN: Plug in your Security Key C NFC via USB-C and tap it, or tap it against your phone (NFC) to authenticate. No batteries, no internet connection, and no extra fees required.
- TRUSTED PASSKEY TECHNOLOGY: Uses the latest passkey standards (FIDO2/WebAuthn & FIDO U2F) but does not support One-Time Passwords. For complex needs, check out the YubiKey 5 Series.
- BUILT TO LAST: Made from tough, waterproof, and crush-resistant materials. Manufactured in Sweden and programmed in the USA with the highest security standards.
- Initial compromise: LastPass reported an intrusion into part of its development environment in August 2022. Its later updates described a separate cloud-storage intrusion that used information from the first incident.
- Access to cloud backups: The ICO penalty notice says an attacker reportedly captured a senior engineer’s master password using a keylogger and used an exfiltrated trusted-device cookie to bypass multi-factor authentication. Together, the access enabled the attacker to obtain cloud credentials and download backup data.
- Customer information in the backups: LastPass said the backups contained configuration data, secrets, metadata, and customer vault backups. It said sensitive vault fields were encrypted, while website URLs and some other fields were not encrypted in the same way. Its March 2023 update said master passwords were not part of the stolen data.
- Regulator findings: In December 2025, the ICO said LastPass UK Ltd had failed to implement sufficiently robust technical and security measures, enabling access to a backup database with personal information relating to up to 1.6 million UK users. It found no evidence that hackers decrypted encrypted customer passwords and other credentials.
The ICO announced a £1.2 million fine; its enforcement listing gives the exact penalty as £1,228,283, issued on 20 November 2025. The UK figure describes the ICO’s stated scope, not worldwide user totals or proof that every affected account’s vault was decrypted.
Sources: ICO announcement; ICO penalty notice; ICO enforcement listing; LastPass incident notice; LastPass March 2023 update.
How the Dashlane incident differed
Dashlane’s June 2026 advisory described an attack on account device registration rather than a cloud-backup compromise. The company said an external party began targeting the flow on 31 May by attempting to brute-force verification tokens. After obtaining valid tokens, attackers registered devices and downloaded encrypted vaults belonging to fewer than 20 personal-plan customers.
Rank #2
- Requires 3 "AAA" batteries (included)
- Unit auto-locks for 30 minutes after 5 consecutive incorrect PINs
Dashlane said it notified the affected users directly, and that its completed investigation found no additional impact or evidence of internal-system compromise. It also said it added network and product protections. On 3 September 2026, the company reported deploying additional verification layers for new-device registration and described broader platform hardening. These impact and remediation details are Dashlane’s statements.
The company said the copied vaults required the user’s master password to decrypt. That does not mean copied ciphertext is risk-free: as with any encrypted vault, its protection depends in part on the strength and uniqueness of the secret used to unlock it. Read Dashlane’s security advisory.
What the two incidents show—and what they do not
| Incident | Attack path described | What the sources say was exposed or copied | What the sources say about decryption or impact |
|---|---|---|---|
| LastPass, 2022; ICO findings published in 2025 | Linked development-environment and personal-device compromises led to credentials and keys used to access cloud backups. | Backup data included personal information, metadata, and customer vault backups. The ICO said saved website URLs were visible to the threat actor. | The ICO found no evidence encrypted passwords and other credentials were decrypted. Its stated UK scope was personal information relating to up to 1.6 million users. |
| Dashlane, 2026 | Attempts to brute-force verification tokens targeted the account device-registration flow. | Dashlane said encrypted vaults belonging to fewer than 20 personal-plan customers were downloaded. | Dashlane said the vaults required users’ master passwords to decrypt and that its investigation found no additional impact or evidence of internal-system compromise. |
Neither case establishes that encryption eliminates breach risk, that every password manager has the same design, or that any provider is immune to attack. Encryption protects particular data under particular conditions; it does not necessarily protect metadata, account flows, user devices, or every system involved in storing and retrieving a vault.
What encryption protects—and what it cannot promise
A zero-knowledge or end-to-end-encryption design can mean a provider does not hold your master password or a key that directly decrypts your vault. It does not prevent an attacker from copying encrypted data, obtaining information outside the encrypted fields, compromising a user’s device, or abusing a provider’s systems or account flows.
Quick wins for a faster PC:
Clear out junk files and repair common Windows errorsFree Scan →Scan for outdated or missing drivers - takes under a minuteDriver Scan →Repair Windows errors before they cause bigger problemsFix Now →LastPass said its stolen vault backups were encrypted and the master password was not included; the ICO found no evidence that encrypted passwords were decrypted. Dashlane said the vaults copied in its 2026 incident required customers’ master passwords to decrypt. These are findings and company statements about specific incidents, not guarantees about every product, configuration, or future attack. The ICO’s penalty notice, LastPass’s update, and Dashlane’s advisory describe those incident-specific claims.
Metadata deserves its own attention. If a field such as a saved website URL is not encrypted, an attacker may learn something about the accounts or services you use without reading the corresponding password. And if encrypted vault data is copied, attackers can attempt guesses offline, outside the normal sign-in process. A long, unique master password makes that guessing harder; it cannot undo a copy that has already happened.
Rank #4
- FIDO-ONLY FUNCTIONALITY: Supports FIDO2 (passkeys) and FIDO U2F protocols for passwordless and second-factor authentication. Does not support OTP, TOTP, Smart Card (PIV), or other advanced features - upgrade to YubiKey 5 Series for extended functionality
- SECURE AND CONVENIENT: Passwordless MFA login with the YubiKey Bio authenticator and biometric information using a fingerprint, with a PIN as a fallback. Simply plug in via USB and use your fingerprint to authenticate
- DEVICE & OS COMPATIBILITY: Compatible with Windows, macOS, ChromeOS, and Linux. Works seamlessly with supported services like Google and Microsoft accounts, and major password managers. See the full compatibility list at "Works With YubiKey"
- DURABLE & RELIABLE: Resistant to tampering, water, and crushing. No batteries or network connectivity required, offering dependable authentication without any downtime. Securely manufactured in USA & Sweden
- Yubico Authenticator App - Fingerprint enrollment, passkey management and PIN configuration available via the app app - Upgrade to YubiKey 5 Series to generate one-time-passwords (OTP) via Yubico Authenticator and for advanced compatibility (OATH, PIV)
What to do if your password manager reports a breach
- Check whether your account was affected. Read the provider’s notice through its official account or support channel. Follow account-specific instructions rather than assuming that a public incident affected every customer. In Dashlane’s 2026 advisory, the company said it contacted the small group whose encrypted vaults were copied and reported no impact to other users’ accounts in that event.
- Secure the master password. Use a long, unique password that you have not reused elsewhere. If it is weak, reused, or may have been captured or phished, change it using the provider’s official process. LastPass warned that weaker, non-default master-password settings reduced the effort needed to guess passwords against stolen vault data.
- Review account access and device enrollment. Check trusted or registered devices and remove ones you do not recognize. Enable the multi-factor authentication method the provider supports. MFA can add protection to account access, but it cannot retrieve data already copied or guarantee safety from every account-recovery or device-registration weakness.
- Change credentials based on exposure. Prioritize passwords for accounts the provider says were exposed, accounts tied to readable information that creates a specific risk, and credentials you suspect were accessed or reused. Change saved passwords as well if the provider advises it or if your master password may have been compromised. Do not assume every user needs to reset every saved password after every incident.
- Watch for targeted follow-up attempts. If exposed information could identify services you use, be alert to convincing password-reset messages or sign-in prompts. Use the service’s official site or app rather than links in unexpected messages.
For incident-specific guidance, consult the LastPass incident notice and Dashlane security advisory.
How to assess a password manager’s security claims
These incidents are not enough to rank password managers. If you are comparing services, look for specific, current information rather than treating a “zero knowledge” label or certification as proof that breaches cannot happen.
Recommended Free Tools
- Encryption coverage: Which vault fields and metadata are encrypted, and where does encryption or decryption take place?
- Key derivation and recovery: How is the master password turned into a key, and what happens if you lose access? A recovery feature may change the security trade-offs.
- New-device enrollment and MFA: How are new devices verified? Which multi-factor options are available, and how can an account be recovered?
- Assessment scope and dates: What systems, product versions, and time period did an independent assessment cover? A past assessment is not proof that every current system has been tested.
- Incident communication and data controls: Does the provider clearly explain what was affected, notify impacted users, and document export and deletion options?
For examples of vendor-published material, Bitwarden’s security FAQs describe its security approach, while 1Password’s security assessments page lists assessments and certifications with scope and dates. Those pages are useful inputs, not a comprehensive independent comparison.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
