LastPass hammered with £1.2M fine for 2022 breach fiasco

The UK's ICO fined LastPass £1.2 million for a 2022 breach that compromised data from 1.6 million UK users. The attack occurred in two stages: first, an attacker compromised a developer's MacBook and stole source code containing encrypted credentials; second, they exploited a Plex vulnerability on a senior DevOps engineer's personal PC to steal decryption keys. The breach exposed email addresses, phone numbers, names, and physical addresses, though passwords remain uncompromised. The fine resulted from LastPass's failure to implement adequate security measures, particularly its policy allowing staff to link personal and business accounts with the same master password, and delayed detection due to miscommunication during its separation from parent company GoTo.