Embattled LastPass Enforcing 12-Character Passwords for All

LastPass is enforcing stronger account protections—requiring a minimum 12-character master password for all users, checking new/reset passwords against breached-credential databases, and enabling MFA re-enrollment—following criticism and a series of 2022 breaches in which a threat actor stole source code and password vault data affecting over 25 million users; the company frames these changes as proactive measures to strengthen vault encryption and customer security.