ICO Fines LastPass £1.2m After 2022 Breach

LastPass was fined £1.2M by the UK ICO for security failings after a 2022 breach in which threat actors compromised employee devices and development resources, stole encrypted credentials and decryption keys (via a keylogger and MFA bypass), and extracted a backup database exposing personal data for roughly 1.6 million users; the ICO noted no evidence that customer master passwords were decrypted and LastPass says it has taken steps to strengthen security.