What Happened
In August 2022, an attacker compromised a LastPass software engineer corporate laptop and used it to access a cloud development environment, stealing source code and technical information. That access was later used in a second stage of the attack to obtain a copy of encrypted customer password vaults along with unencrypted account information, including names, billing addresses, email addresses, and phone numbers.
The breach became especially damaging because attackers spent the following years attempting to crack the stolen encrypted vaults offline. According to blockchain forensics researchers, this ultimately led to more than 35 million dollars in stolen cryptocurrency across 2024 and 2025 alone, attributed to the vault contents being used to access victims crypto wallets, with researchers describing that figure as likely only a fraction of total losses.
The Settlement
LastPass agreed to pay up to 24.5 million dollars to resolve the consolidated class action, In re: LastPass Data Security Incident Litigation, without admitting wrongdoing. The settlement creates two separate funds: an 8.2 million dollar fund for general losses and statutory payments, and a larger 16.25 million dollar fund specifically for class members who can document cryptocurrency losses connected to the breach.
Reported potential individual awards include a flat 25 dollar statutory payment for those who do not document specific losses, up to 10,000 dollars for documented ordinary and extraordinary losses, a 100 dollar payment specifically for California residents under state privacy law, and up to 900,000 dollars for documented cryptocurrency losses tied to the breach, though actual payouts will depend on the total number of valid claims filed against each fund.
How to Claim and Key Dates
To be eligible, you generally need to have received an email notice from LastPass about the 2022 incident or the settlement, indicating your account data was involved. Claims can be submitted online using the Unique ID and PIN provided in that notice, or by contacting the settlement administrator directly if the notice was lost.
The settlement received preliminary approval from a federal court in Massachusetts in early 2026. The deadline to submit a claim is July 2, 2026, with a final approval hearing scheduled for July 14, 2026. Payments from the regular cash fund are not expected before September or October 2026 at the earliest, with the timeline for the cryptocurrency fund potentially differing based on the complexity of verifying those claims.
How to Get Legal Help
Check if you received a notice: you generally need an email notice from LastPass about the 2022 incident or the settlement, containing a Unique ID and PIN, to file online at the official settlement website.
Determine which fund applies: general losses, including a flat statutory payment or documented ordinary and extraordinary losses, are covered by an 8.2 million dollar fund, while documented cryptocurrency theft connected to the breach is covered by a separate 16.25 million dollar fund with potentially much larger individual payouts.
Gather documentation for larger claims: receipts, invoices, bank or credit card statements, or blockchain records showing your specific losses will generally be required for anything beyond the flat statutory payment.
File before the deadline: claims must be submitted online or postmarked by July 2, 2026, with a final approval hearing scheduled for July 14, 2026 and payments not expected before September or October 2026 at the earliest.
To follow any further developments, bookmark this page and subscribe to LawsuitWatch alerts.
Free Legal Evaluation
Do You Qualify to File a Claim?
Our network of verified plaintiff attorneys offers free, no-obligation case evaluations. Contingency fee representation means you pay nothing unless you win.
LastPass Class Action: The $24.5 Million Settlement: Frequently Asked Questions
Answers to the most common questions about this case and your legal options.
What was the LastPass breach about?
A 2022 two-stage attack in which a hacker first compromised an employee laptop to access development systems, then later used that access to steal encrypted customer password vaults and unencrypted account information.
Why did the breach lead to stolen cryptocurrency?
Attackers spent subsequent years attempting to crack the stolen encrypted vaults offline, which researchers say led to more than 35 million dollars in cryptocurrency theft from victims whose crypto wallet credentials were stored in those vaults.
How much is the settlement worth?
Up to 24.5 million dollars total, split into an 8.2 million dollar fund for general losses and statutory payments and a 16.25 million dollar fund specifically for documented cryptocurrency losses connected to the breach.
What is the deadline to file a claim?
July 2, 2026. A final approval hearing is scheduled for July 14, 2026, and payments from the general fund are not expected before September or October 2026 at the earliest.
Do I need proof to get paid?
A flat 25 dollar payment does not require documentation, but larger claims for ordinary, extraordinary, or cryptocurrency losses require documentation such as receipts, statements, or blockchain records showing your specific losses.