By 
People keep asking me if LastPass is still safe on Android. The honest answer took four years to earn: stronger on paper, permanently less trusted. My test phone is a Tecno Spark 40 on HiOS.
This is the post-mortem. It prices what happened, what changed and who should stay or switch, both cases written fairly.
Is it still safe? The quick summary
- The 2022 theft remains the real event: vault backups went, URLs in clear text with them.
- June 2026 was a supplier incident. Support-case and sales data went. Vaults did not.
- The settlement pays up to $24.45 million, US class only. Claims closed on 2 July 2026.
- Stay on cleaned-up terms: fresh master password, MFA, no seed phrases in the vault.
- Switch if any of those break. Seeds in the vault means the vault is burned.
One honest line: no links here are affiliate links. Every link here is a plain link, and the full affiliate disclosure is one tap away.
2022: the vault theft, dated
Between 8 and 11 August 2022, an attacker compromised a developer's laptop at LastPass and took 14 source code repositories. The same grab included the encrypted key guarding the AWS S3 backup buckets. Wikipedia's breach article, read on 13 November 2026, carries the timeline.
On 12 August 2022, a senior DevOps engineer's home PC fell through an unpatched Plex server. A keystroke logger caught that engineer's master password.
On 20 August 2022, the actor pulled the engineer's employee vault holding the keys. The user database and encrypted vault backups followed by 16 September. AWS alerts fired on 15 and 22 October 2022; a mailing-list error hid them until 2 November.
LastPass said on 25 August 2022 it had "seen no evidence" of customer data access. On 15 December 2022 it confirmed the backup database was copied. Its incident notice, read on 13 November 2026, states it plainly.
The backups held vaults under 256-bit AES, plus names, emails, billing addresses, partial card digits, IP addresses and plain-text URLs. The 2018 defaults were not met by every account: 12-character master passwords, 100,100 PBKDF2 iterations.
What followed: seeds, suits and a fine
Krebs on Security tallied more than 150 cracked vaults and over $35 million by September 2023. In March 2025, investigators tied a $150 million heist to the same breach. Both figures sit in the Wikipedia article above, read on 13 November 2026.
malcare's review, updated 12 May 2026 and read on 13 November 2026, puts the late-2024 wave at about $5 million. Encrypted passwords have never been publicly confirmed cracked at scale. The linked cases involve seed phrases.
The UK's ICO fined LastPass UK Ltd £1,228,283 on 20 November 2025 over failures affecting more than a million UK data subjects. The sum was cut 30 percent to reflect measures in place and added afterwards, per the Wikipedia article above, read on 13 November 2026.
In September 2025, LastPass finished encrypting URL and URL-related fields, phase two of a project started in 2024. Until then, every URL in every stolen vault sat in clear text.
In January 2026, a phishing wave began on or around 19 January, pushing fake 24-hour vault-backup mail; a second wave followed on 22 January. LastPass's January 2026 notice, read on 13 November 2026, is plain: no one at LastPass will ever ask for your master password.
June 2026: a supplier, not the vault
On 12 June 2026, LastPass learned Klue, a market-intelligence platform it uses, had been compromised. Hackers used Klue's OAuth tokens to enter its Salesforce. LastPass's security notice, published 22 June and read on 13 November 2026, owns the dates: ten days from discovery to disclosure.
What was taken: names, phone numbers, emails, physical addresses, support-case data, sales data. What was not: vaults or infrastructure. It also says there is no evidence the actor reached Gong data.
TechCrunch, read on 13 November 2026, reports Icarus took credit for the Klue hack. It counts LastPass at 33 million-plus users, with 1.6 million paying customers as of 2024.
The real damage is ordinary. Support cases likely carry fragments of private data; exposed contacts make convincing lures. LastPass told customers to expect phishing built on both. The vault was not opened.
| Incident | Scope | Source |
|---|---|---|
| Aug to Sep 2022 | Developer laptop, then DevOps home PC via an unpatched Plex server; backups and vaults copied; URLs in clear text | Wikipedia; LastPass notice |
| Sep 2023 | Offline cracking reported; 150+ victims; $35M+ crypto | Wikipedia |
| Late 2024 | About $5M wave tied to seed phrases in vaults | malcare |
| Nov 2025 | ICO fined LastPass UK Ltd £1,228,283; one million+ UK data subjects | Wikipedia |
| Jan 2026 | Phishing; fake 24-hour vault-backup lure; second wave 22 January | LastPass notice, January 2026 |
| Jun 2026 | Klue supplier breach; names, contacts, support cases; vaults untouched | TechCrunch; LastPass notice |
The settlement, in two pools
Wikipedia, read on 13 November 2026, prints $24.5 million, $16 million for crypto. Claim Depot's tracker, updated 31 October 2026, splits it. $8.2 million cash, a $16.25 million capped crypto pool, $24.45 million in total if every dollar is paid.
The cash pool covers $25 statutory payments, up to $300 ordinary and up to $10,000 extraordinary. Everything is pro rata; a heavy claims week shrinks every payment. Crypto victims can claim up to $900,000 each.
Claims closed 2 July 2026. A final approval hearing was held on 14 July 2026. Claim Depot's 31 October 2026 update note and claimmoney.com, read on 13 November 2026, both report the court approved on 30 September 2026. Payments expected from September or October 2026 remain unconfirmed; the crypto pool pays around March 2027. The class is US residents and US-registered businesses.
Both online figures describe the same ceiling two ways: $24.5 million rounded, $24.45 million itemised. The itemised caps decide who got what.
| The pool | The cap | Who is in | Status |
|---|---|---|---|
| Cash fund | $8.2M | Class members: $25 statutory; up to $300 ordinary; up to $10,000 extraordinary; pro rata | Claims closed 2 July 2026; hearing held 14 July 2026 |
| Crypto pool | $16.25M | Validated crypto victims, up to $900,000 each, pro rata | Payment around March 2027 at the earliest |
| Fees, both pools | Up to $2,870,000 from cash; up to $5,687,500 from crypto | Class counsel; $140,000 service awards from cash | Taken from the funds, not on top of them |
LastPass pays up to $24,450,000 in total. Nigerian readers sit outside this class; no docket carries your name and no cheque is coming. The habit lesson is yours.
The rebuild: what the vendor says, and what it is worth
LastPass's own security page, read on 13 November 2026, claims 600,000 PBKDF2 iterations, up from 100,100 in 2022. It lists SOC 2 Type II, ISO 27001, SOC 3, BSI C5 and TRUSTe, an IRAP assessment and a Google Play Independent Security Review. Vendor claims, not verdicts.
The same page calls the company "more secure than ever" and touts a secure software factory with SBOM tracking and SLSA compliance. The Trust Center holds the underlying reports; I have not audited them.
malcare's review, updated 12 May 2026 and read on 13 November 2026, confirms zero-knowledge AES-256 with PBKDF2 SHA-256. It also confirms URL-field encryption finished in September 2025, and legacy iteration counts that kept old vaults on weak maths for years. The rebuild is real. The trust gap is rational.
A certificate is not a pardon. Certs say an auditor saw controls on certain dates. They do not unsay 2022, and they do not resurrect stolen data.
Stay or switch: the triggers
The stay-case is real, with conditions. malcare models it: you changed your master password, rotated your key accounts, turned on MFA and never stored seed phrases. Then the breach is history, not a countdown.
The switch-case is also real. Seeds or private keys in any cloud vault are the one automatic fail. Vaults cracked offline do not refund what is spent. Leave, and treat every stored secret as exposed.
The picks live in our best password manager guide for Android, which names Bitwarden for free and 1Password for paid. The 1Password versus Bitwarden duel is its own guide, not written yet.
| The profile | The verdict | The first step |
|---|---|---|
| Fresh master password, MFA on, no seeds | Stay, fairly | Run the security dashboard audit |
| Seeds or private keys ever in the vault | Switch, today | Move secrets to cold storage; change every account they touched |
| Never rotated anything after 2022 | Switch | Start with email, banking, SIM portal, then Google or Apple ID |
| Trust broken for you, permanently | Switch | Export, import, delete the CSV, re-enrol 2FA |
| Likes the product, casual about hygiene | Stay with terms | Fresh master password; MFA on; dashboard audit this week |
| Household sharing; Families value | Stay, decent value | Household plan: malcare read $4 monthly in May 2026 |
| Wants open source or a cleaner breach story | Switch | Bitwarden (free, open) or 1Password (paid, trial first) |
Every stay row ends the same way: MFA, no seeds. Every switch row starts the same way, on a desktop browser, because phone export is where migrations die.
The 30-minute move
PanicVault's switch guide, updated 4 November 2026 and read on 13 November 2026, times the move at about 30 minutes on a desktop browser. The path: LastPass.com, Advanced Options, Export, CSV, then import.
What breaks: shared folders (the sharer hands those over separately), file attachments, password history, TOTP secrets in LastPass Authenticator, form-fill data. The CSV is your whole password list in plain text; delete it after import, and empty the bin.
Re-enrol two-factor codes before you delete anything. For every account on LastPass Authenticator, turn 2FA off there, turn it on in the new manager, and save the recovery codes. Skip that and you will lock yourself out.
Spot-check email and banking before you trust the import. The new manager installs from its official store listing: Bitwarden or 1Password.
If you stay, keep the app updated. The official Android build is on Play, and a stale install is how patched bugs come back.
Run both managers for two weeks, then deactivate the old one: Account Settings, My Account, Delete Account. It is one-way, so export first, always.
The Nigeria note
The settlement excludes you. The class is US residents and US-registered businesses, so no docket carries your name. Your main risk is phishing; no payout is coming.
The free tier limits you to one device type, computers or phones, and includes dark web monitoring for a small set of email addresses. Both limits are the deal as sold, per malcare's review, read on 13 November 2026.
A vault does not stop a SIM swap. Whoever holds your line gets the one-time codes. Lock your SIM with a PIN and never share an OTP, not even for "verification".
The decision here is trust, not money. My method sits in how we test.
Questions readers ask
Is it still safe to use?
Fairly, on cleaned-up terms: fresh master password, MFA, no seed phrases, an audited vault. The rebuild is real. The trust gap is yours to price.
Were the June 2026 vaults stolen?
No. The June 2026 incident hit a supplier, Klue. Names, contact details and support-case data went. Vaults did not, per LastPass's statement on 22 June 2026.
Were the 2022 vaults cracked at scale?
No public confirmation of password cracking at scale exists. The confirmed losses were crypto: more than 150 thefts in 2023 and a $150 million heist in 2025.
Does anyone in Nigeria get settlement cash?
No. The class is US-only. Claims closed on 2 July 2026. Readers here keep the habit, not the cheque.
Should I stay or switch?
Switch if seeds ever sat in the vault, you never rotated after 2022, or the trust is gone for good. Stay only on the cleaned-up terms in the triggers table above.
What to do next
Stay: fresh master password, MFA on, dashboard audit today. Switch: desktop export, import, delete the CSV, re-enrol 2FA, deactivate after two clean weeks. Either takes less time than the 2022 cleanup people are still attempting.
Comments
New posts held for reviewCouldn't load comments - the thread service didn't answer. Nothing is being hidden: no approved comments are saved with this page.
No approved comments yet - the first one is yours. New posts are held for review before they appear.