← All breach guides

LastPass Data Breach — Exercise Your GDPR Rights

LastPass suffered a serious two-stage breach in 2022: first, attackers stole source code in August; then in December, they accessed customer data including encrypted password vaults. Every LastPass customer's data was potentially exposed.

⚖️ Regulatory action: LastPass has not been publicly fined under GDPR as of 2025, but the breach is under regulatory review in multiple EU jurisdictions.

What happened

2022 All LastPass customers affected

In a two-stage attack, hackers first stole source code and technical information, then used it to access a cloud backup containing encrypted customer password vaults along with unencrypted account metadata.

Data exposed:
  • Encrypted password vaults
  • Website URLs stored in vaults (unencrypted)
  • Email addresses
  • Billing addresses
  • Telephone numbers
  • IP addresses used to access LastPass
  • Partial credit card numbers

What you can do

LastPass held some of the most sensitive data imaginable — encrypted vaults containing all your passwords. A GDPR access request reveals what account metadata they hold, how it was secured, and what third parties it was shared with. You may also have grounds for erasure.

You have two key rights under GDPR:

Note: LastPass is operated by LastPass US, LP. EU customers can submit data requests via their privacy portal. Privacy portal ↗

Generate your access request

Fill in your details below. Address the completed letter to LastPass's Data Protection Officer — find the contact details via the link above.

Dear Data Protection Officer,

I am writing to exercise my rights under the General Data Protection Regulation (GDPR). As an individual whose personal data you process, I am requesting the following information:

  1. Confirmation that you are processing my personal data.
  2. A copy of my personal data.
  3. The purposes of the processing.
  4. The categories of personal data concerned.
  5. The recipients or categories of recipients to whom my personal data has been or will be disclosed.
  6. The envisaged period for which my personal data will be stored, or the criteria used to determine that period.
  7. The existence of my right to request rectification or erasure of my personal data, or restriction of processing, or to object to such processing.
  8. Information about the source of my personal data if it was not collected directly from me.
  9. The existence of automated decision-making, including profiling, and meaningful information about the logic involved.

Below is my information for your reference:

Name:
Email:
Address:

This request is of utmost importance to me and should not be ignored. The GDPR mandates that you respond within one month. Failure to comply may result in further action being taken.

Thank you for your prompt attention to this matter.

Sincerely,,

Text copied to clipboard

1. Copy and send this letter to the data controller of the organisation.

2. Follow up until you hear back. The GDPR requires a response within one month.

3. No response? Lodge a complaint with your local data protection authority.

No response after one month? File a complaint with your DPA →

Select your country to find your data protection authority:

Share: