ICO Fines LastPass £1.2m After 2022 Breach

LastPass has been fined £1.2m ($1.6m) by the UK’s data protection watchdog for security failings that led to a major 2022 data breach.

The Information Commissioner’s Office (ICO) judged that the password management provider failed its customers by not putting in place sufficiently robust technical and security measures.

The regulator admitted there’s no indication that threat actors were able to decrypt customer passwords. That’s because the master password required to access password vaults is stored locally on customers’ devices

However, an estimated 1.6 million users were affected by the breach. Personal information including customer names, emails, phone numbers, and stored website URLs were apparently compromised.

Information commissioner, John Edwards, said the watchdog continues to recommend the use of password managers by businesses and consumers as a way to improve identity and access management (IAM).

“However, as is clear from this incident, businesses offering these services should ensure that system access and use is restricted to ensure risks of attack are significantly reduced,” he added.

“LastPass customers had a right to expect the personal information they entrusted to the company would be kept safe and secure. However, the company fell short of this expectation, resulting in the proportionate fine being announced today."

The breach involved several stages:

Chris Linnell, associate director of data privacy at consultancy Bridewell, pointed to several lessons learned.

“For service providers, this is a reminder that security isn’t just the product itself,” he explained. “You need strong information security and privacy frameworks in place, and you can’t ignore the less obvious risks – backups, secondary databases, and other systems that attackers often target.”

The breach also shows why acceptable use policies matter, Linnell added.

“Staff need clear guidance on what they can and can’t do with company devices,” he said. “In this case, the vulnerability came from a third-party streaming service – approved or not – which also serves as another reminder how much risk sits in the supply chain. We’ve seen this before, and it’s not going away."