$8.2M LastPass Settlement Ends Class Action Lawsuit Over 2022 Data Breach

New to ClassAction.org? Read our Newswire Disclaimer

LastPass has agreed to an $8,200,000 settlement to resolve a class action lawsuit that alleged the password manager failed to prevent an unauthorized actor from exfiltrating reams of source code and technical information, which was later used to steal credentials and keys to the company’s cloud-based storage service in a 2022 data breach.

Don’t miss the next class action settlement deadline. Sign up for ClassAction.org’s free weekly newsletter.

The $8.2 million LastPass class action settlement received preliminary approval from the court on February 2, 2026 and covers all natural United States residents, as well as all companies, entities, and organizations registered to do business in the U.S., whose LastPass accounts may have been compromised, extracted, copied, stolen or otherwise exposed as a result of the 2022 LastPass data breach, and whose account actively contained data at the time of the incident.

ClassAction.org will update this page when the court-approved LastPass data breach settlement website is launched.

According to the settlement notice, LastPass settlement class members who file a timely, valid claim form will have multiple options for reimbursement.

Those who submit with their claim form documented proof of ordinary losses traceable to the LastPass data breach can receive a one-time cash payment of up to $300, court documents state. The notice relays that class members who elect to receive this cash benefit must have an active LastPass account with information stored in it. Per settlement documents, reimbursable data breach-related expenses include costs related to credit monitoring, identity protection and restoration, dark web monitoring, and other security services.

Per court documents, LastPass class members who submit with their claim form documented proof of extraordinary losses are eligible to receive a one-time cash payment of up to $10,000. Extraordinary losses stemming from the LastPass data incident must have been incurred as a result of the breach and cannot have been reimbursed by any other payout options, court documents state.

In lieu of a documented-loss payment, class members with an active LastPass account in which information is stored may instead elect to receive a one-time, $25 statutory payment, the notice relays. Furthermore, class members who resided in California at the time of the LastPass data breach may receive an additional $100 statutory cash payout due to state-specific provisions under the California Consumer Privacy Act.

In addition to any cash payouts from the class action settlement, court documents continue, class members may also file a LastPass claim form to receive reimbursement for any cryptocurrency losses alleged to have been caused by the data breach. The notice outlines that each class member may receive up to $900,000 in cryptocurrency payouts, as determined by a court-appointed crypto master, subject to an aggregate cap of $16,250,000 separate from the LastPass settlement fund.

Finally, in addition to cash payouts and cryptocurrency reimbursements, all LastPass settlement class members will be offered a complimentary six-month upgrade to a LastPass Premium Account, as well as automatic enrollment in LastPass Dark Web Monitoring services.

According to the notice, class members do not need to file a claim form to receive dark web monitoring through the settlement, and class members who file a claim form to receive premium benefits will have their accounts automatically updated upon final settlement approval.

ClassAction.org will update this page with more information about filing a LastPass claim form and receiving settlement benefits as it is published by the settlement administrator.

The court will determine whether to grant final approval to the LastPass data breach settlement at a hearing on a later date. Compensation will begin to be distributed to class members only after final approval is granted and any appeals are resolved.

The LastPass class action lawsuit argued that the password manager implemented poor data security practices that failed to safeguard the confidential information of millions of consumers and businesses, which allegedly allowed an unauthorized cybercriminal group to breach the company’s systems in or around August 2022. Per court documents, the private information that may have been affected by the cyberattack included names, addresses, contact information and passwords to personal and financial accounts.

Check out ClassAction.org’s free legal resources to learn how to file a class action lawsuit.