LastPass got breached again - but this time your password vault is safe

LastPass told users on June 23 that it had been caught up in another data breach. If you use it, here's the important part first: this one did not touch password vaults. The encrypted vault where your actual logins live was not affected.

What did leak was contact information - names, email addresses, phone numbers, physical addresses and support-case details - and it came through a third party, the market-research firm Klue, rather than LastPass's own systems. LastPass has been breached before (2015 and 2022), so the reflex worry is fair, but the exposure this time is your contact details, not your credentials.

The real danger from a leak like this is targeted phishing: scammers now have your name, email and phone, and can write a convincing "LastPass security alert" that pressures you into handing over your master password. So treat any urgent LastPass email or text with suspicion, never click a login link inside one, and make sure two-factor authentication is on. Your master password is the one thing they still don't have - keep it that way.

A breach is almost always followed by a phishing wave. Tendvane can't stop the emails, but its Safety check and browser-hijack repair help if a phishing link ever leads to something landing on your PC.