Password Manager Security Breach: What Happened & How to Stay Safe

Why Password Managers Get Targeted

Hackers are attracted to password managers because they're searching for weak points at organizations meant to hold the keys to the kingdom for millions of users and enterprises. A single compromised password manager account can potentially expose dozens or hundreds of other logins—making these services far more attractive targets than individual websites.

But the reality is more nuanced than the headlines suggest. Password managers are still recommended over using manually created passwords on each application or service you use, even with the chance of a breach. The security tools exist precisely because creating and remembering truly unique, complex passwords for each account is unrealistic.

The LastPass Disaster: A Case Study in What Went Wrong

The 2022–2023 LastPass breaches represent the most significant password manager security incident to date and offer critical lessons. In the first incident, an attacker accessed parts of LastPass's development environment and exfiltrated source code repositories and technical documentation, including an encrypted copy of the key used to protect backups of customer data.

But the second breach was far more damaging to users. A senior DevOps engineer's personal computer was compromised, and the attacker used a keystroke logger to obtain the employee's credentials and access an internal vault holding further keys. This enabled access to and exfiltration of a backup database and copies of some customers' password vault data, which included both unencrypted fields (such as some website URLs) and encrypted fields (such as usernames and passwords).

The consequences extended well beyond the breach itself. In 2025, LastPass settled a class action lawsuit in the amount of $24.5 million for losses incurred by customers whose vaults had been accessed. And the damage was still unfolding years later: In September 2023, journalist Brian Krebs published research from independent investigators connecting a wave of six-figure cryptocurrency thefts—over $35 million from roughly 150 victims—to master passwords cracked from the stolen LastPass vaults.

Recent Breaches: Dashlane and Emerging Threats

The threat landscape has not improved. Password manager maker Dashlane says hackers have obtained at least a dozen encrypted vaults used for storing customer passwords during a weekend cyberattack. The external attacker launched a brute-force attack against its two-factor authentication system, successfully bypassing 2FA protections on fewer than 20 personal plan user accounts and downloading copies of their encrypted password vaults.

Beyond isolated breaches, attacks to breach the security of password managers have drastically increased in 2024, with malware targeting 25 percent of credentials stored in password managers in 2024—a 3x increase as compared to the year 2023.

Additionally, in February 2026, researchers at ETH Zurich and the Università della Svizzera italiana published a study identifying 27 vulnerabilities across four major password managers—Bitwarden, LastPass, Dashlane, and 1Password—ranging from vault integrity issues to potential full vault compromise under a malicious-server threat model.

How Password Manager Encryption Actually Works

Before discussing vulnerabilities, it's important to understand the security architecture. A password manager is software that generates, encrypts, and autofills strong, unique passwords so you only need to remember one Master Password.

Encryption is the backbone of a password manager's security. These tools employ complex encryption algorithms to transform passwords into unreadable code, which only the correct key (your master password) can decipher. Typically, this process involves advanced encryption standards like AES-256, which boasts robustness against hacking attempts.

The industry standard is