LastPass: how a home media server extended a breach

I have everything I need. Here is the post.

The front door was a movie library

In late 2022, the login credentials protecting the encrypted password vaults of roughly 25 million people were sitting on a set of cloud servers at LastPass, one of the most widely used password managers in the world. To reach them, an attacker did not break LastPass's encryption, phish an executive, or find a zero-day in the product. They compromised a single engineer's home computer, and the way in was a piece of consumer software most people associate with watching movies on the sofa: an out-of-date copy of Plex Media Server. Three years later, U.S. federal investigators would link that break-in to the theft of roughly $150 million in cryptocurrency from a single victim, according to Krebs on Security, and to a slow-motion drain of stolen wallets that researchers are still tracing in 2025. It is one of the clearest case studies we have of how the blurry line between "work laptop" and "home network" can turn a missed software update into a systemic failure.

Two break-ins, not one

The story the public first heard was small. On 25 August 2022, LastPass CEO Karim Toubba posted a short notice saying that "an unauthorized party gained access to portions of the LastPass development environment through a single compromised developer account and took portions of source code and some proprietary LastPass technical information." Crucially, he added that the company saw "no evidence" that customer data or encrypted vaults had been touched. The investigation into this first incident was closed on 15 September 2022. That reassurance turned out to be premature, because the first break-in was only the opening move. The attacker had walked away with source code and internal technical documentation, and they used it as a map. Between roughly 12 August and 26 October 2022, a second intrusion unfolded, one the company did not fully understand until AWS security alerts flagged anomalous activity, as the arXiv case study Breaking the Vault reconstructs. The reason the two incidents are treated as one breach is that the second depended on the first. LastPass's own detailed disclosure put it plainly: the threat actor combined "information stolen during the first incident, information available from a third-party data breach, and a vulnerability in a third-party media software package" to mount a "coordinated second attack." In other words, the company patched the first hole, declared victory, and never realised the same intruder was already tunnelling in through a completely different, and far more personal, route.

A media server as the entry point

The route was one of only four people. To reach the encrypted customer backups, an attacker needed decryption keys stored in Amazon S3 cloud buckets, and only four senior DevOps engineers at LastPass had access to those keys. The attacker studied the target and picked one of the four. Rather than attack that engineer's hardened corporate laptop, they went after the machine sitting in the engineer's house. That machine was running Plex Media Server, the popular software that lets you stream your own library of films, TV, and music to your phones and TVs. LastPass itself never named the vendor, describing only a "third-party media software package," but Plex later confirmed to reporters that it was their product.

The specific weakness was CVE-2020-5741, an "insecure deserialization" flaw in Plex Media Server on Windows. Deserialization is the process of turning stored bytes back into a live program object; when a program does this without checking what it is reconstructing, an attacker can smuggle in an object that runs code instead of just holding data. In Plex's case, as Tenable's security researchers documented, the server used Python's pickle.load() on a plugin file without validation. An attacker who could reach the admin's Plex account could abuse the Camera Upload feature to plant a malicious file, point the server at it, and trigger the server to execute arbitrary code, a classic authenticated remote-code-execution bug rated high severity by the U.S. National Vulnerability Database. Here is the detail that makes the whole thing sting. Tenable reported the flaw to Plex on 31 March 2020, and Plex shipped a fix in version 1.19.3.2764 on 7 May 2020, more than two years before the LastPass attack. The patch was available; it was simply never installed. As Plex put it afterward, "the LastPass employee never upgraded their software to activate the patch," noting that the fixed version "was roughly 75 versions ago."

Getting past the multi-factor prompt

Once the attacker had code execution on the engineer's home computer, they did something patient rather than clever: they installed a keylogger, a tool that silently records every keystroke. This is worth sitting with, because it dismantles a common misconception. People often treat multi-factor authentication (MFA), the second step where you approve a login with your phone or a code, as a wall that stops attackers cold. It is not a wall so much as a gate that closes after you walk through it. The keylogger did not need to defeat MFA at all. It waited for the engineer to authenticate normally, with their second factor, and then captured the master password as they typed it into their own already-trusted session, according to LastPass. MFA verified that the right person was logging in. It could say nothing about the fact that the person's keyboard was bugged. With the master password in hand, the attacker unlocked that engineer's corporate LastPass vault, and inside it were the DevOps secrets and decryption keys that guarded the S3 backups. From there they helped themselves to the crown jewels: backups of customer vault data, DevOps and API secrets, third-party integration secrets, and configuration data. A backup of the LastPass multifactor and federation database was itself encrypted, but, LastPass acknowledged, the key needed to decrypt it was among the secrets the attacker had just stolen. The attacker had two months of undetected access before AWS alerts finally surfaced the activity on 26 October 2022.

What actually left the building

When LastPass finally spelled out the damage in a 22 December 2022 update, the company drew a careful line between two kinds of data, and that line is the heart of the whole affair. Some fields were taken in the clear. The stolen backups contained "basic customer account information and related metadata including company names, end-user names, billing addresses, email addresses, telephone numbers, and the IP addresses from which customers were accessing the LastPass service." The vault archives themselves also included unencrypted website URLs for every saved login. Other fields were encrypted. Website usernames and passwords, secure notes, and form-filled data were, in the company's words, "fully-encrypted sensitive fields." Those fields, LastPass emphasised, "remain secured with 256-bit AES encryption and can only be decrypted with a unique encryption key derived from each user's master password," strengthened with "100,100 iterations of the Password-Based Key Derivation Function (PBKDF2)." Read quickly, that sounds reassuring: the sensitive stuff is encrypted, and LastPass never stores your master password, so the vaults are safe. Read carefully, it contains two quiet alarms. First, the unencrypted URLs are themselves sensitive: they reveal that you bank at a particular institution, use a specific crypto exchange, or hold an account on a given service, a target list for anyone deciding whom to attack. Second, and more importantly, "encrypted" here is doing a lot of load-bearing work, because the strength of that encryption is not the same for every customer.

The number that decides everything

The phrase "100,100 iterations of PBKDF2" is easy to skip past, but it is the pivot on which every stolen vault turns. A password manager cannot store your master password; if it did, a breach like this one would be the end of the story. Instead it runs your master password through a deliberately slow mathematical function, PBKDF2, many times over, to derive the key that unlocks your vault. The "iterations" count is how many times it repeats that work. A higher count makes each guess more expensive. That is exactly what you want when an attacker has your encrypted vault sitting on a hard drive and can guess offline, as fast as their hardware allows, with no server to rate-limit them or lock them out.

The problem is that 100,100 was not everyone's number. As security researcher Wladimir Palant documented in detail, LastPass's default iteration count climbed over the years, from 1, to 500 in 2012, to 5,000 in 2013, to 100,100 only in February 2018. The catch: when LastPass raised the default, it did not force existing accounts to upgrade. Long-time users could still be sitting at 5,000 iterations, or even 500, without knowing it. An old account might therefore be more than a hundred times cheaper to attack than a new one, purely because it predated a change the customer was never told to make. That difference is not academic. Against a modern graphics card, a vault at a low iteration count with a mediocre master password can be cracked in a realistic amount of time, while the same vault at 100,100 iterations with a long, random password would take effectively forever. The attacker did not have to break AES. They only had to find the customers whose maths was weak, and the unencrypted URLs told them which of those customers had something worth the effort.

The consequence arrived slowly

For a long time, the breach's real cost was theoretical. Then it started showing up on the blockchain. Independent investigators, chiefly ZachXBT and MetaMask's Taylor Monahan, along with researcher Nick Bax, began noticing a strange pattern of cryptocurrency thefts in 2023 and 2024. The victims did not share the usual precursors, no phishing, no SIM-swaps, no malware on their phones. What they did share was that they had stored crypto seed phrases and private keys in the "secure notes" of their LastPass vaults before the 2022 breach, and that they tended to have older accounts with weaker master passwords. The through-line was unmistakable: someone was cracking the stolen vaults offline and draining whatever wallets they found inside.

The single largest known loss came on 30 January 2024, when roughly $150 million in XRP was stolen from personal wallets belonging to Chris Larsen, the co-founder of Ripple. Larsen initially described it as a company-adjacent security matter; ZachXBT was first to trace it to his personal holdings. In March 2025, Krebs on Security reported that the U.S. Secret Service and FBI had concluded the funds were stolen using credentials from the LastPass breach, and had seized roughly $23 to $24 million of the proceeds. A federal seizure complaint stated that "the stolen data and passwords that were stored in several victims' online password manager accounts were used to illegally access the victims' electronic accounts." The thefts have not stopped. By late 2025, blockchain-analytics firm TRM Labs and others estimated that tens of millions of dollars had been drained across multiple waves, with a large share laundered through privacy tools, and a fresh wave surfacing as recently as September 2025. Because a cracked vault yields keys that never expire, the loot from a 2022 breach can keep paying out for years, on the attacker's schedule, not the victim's.

What this leaves behind

The tidy lesson, "patch your software," is true but too small. The engineer's failure to update Plex was the trigger, yet the breach was really a story about assumptions that no longer hold. The most important of those is the perimeter. In a remote-work world, the boundary between a corporate environment and someone's living room is a matter of network configuration, not physics. A vulnerability in hobbyist media software became a vulnerability in an enterprise vault because both lived on machines the same person used. Least-privilege design was supposed to contain that: LastPass had narrowed the decryption keys to four people. But four is not zero, and a determined attacker only needs one of the four to be careless at home. The keylogger's patience is the other lesson. MFA raised the cost of a remote login; it did nothing once the attacker owned the endpoint and could simply watch the master password being typed. For ordinary users, the practical takeaways are unglamorous and specific: check your password manager's iteration count and raise it if it is low, never store crypto seed phrases or recovery keys in the same vault as everyday logins, and treat any secret that lived in a breached vault as already compromised, no matter how strong you think your master password is. That last point is the one LastPass was slowest to say out loud, and the one Taylor Monahan argues most sharply: a stolen vault is not a risk that passes. It is a countdown. The open question is how many of those countdowns are still running. Millions of vaults were exfiltrated in 2022. Investigators can only see the ones that surface as a traceable theft. The quiet ones, older accounts, weaker passwords, secrets no one has gotten around to cracking yet, are still out there, and they will still unlock exactly what they unlocked four years ago.

---

Sources

1. LastPass, "Notice of Recent Security Incident" (December 2022 update), 2022–2023.
2. The Hacker News, "LastPass Hack: Engineer's Failure to Update Plex Software Led to Massive Data Breach", 2023.
3. BleepingComputer, "LastPass: DevOps engineer hacked to steal password vault data in 2022 breach", 2023.
4. Tenable, "Plex Media Server Authenticated Python Deserialization / RCE (Windows)" (TRA-2020-32), 2020.
5. U.S. National Vulnerability Database, "CVE-2020-5741", 2020.
6. Krebs on Security, "Feds Link $150M Cyberheist to 2022 LastPass Hacks", 2025.
7. The Hacker News, "LastPass 2022 Breach Led to Years-Long Cryptocurrency Thefts, TRM Labs Finds", 2025.
8. Wladimir Palant (Almost Secure), "LastPass breach: The significance of these password iterations", 2022.
9. arXiv, "Breaking the Vault: A Case Study of the 2022 LastPass Data Breach", 2025.
10. Wikipedia, "2022 LastPass data breach", accessed 2026.