Have Password Managers Been Hacked? What Really Leaked

Yes, password managers have been hacked, but not in the way the headlines suggest. In the best-known case, LastPass lost copies of customer vaults in 2022, and regulators found no evidence the attacker could open the encrypted passwords inside. Norton Password Manager accounts were taken over in 2022 because people reused passwords, not because Norton's systems were cracked. KeePass had a flaw that let someone with access to your computer's memory recover the master password. Each case teaches the same lesson: a manager is still far safer than reusing passwords, but only if your master password is strong, the account has two-step verification and the device is clean.

Short answer: should you stop using one?

• No. The UK Information Commissioner, after fining LastPass, said password managers are "a safe and effective tool" and that the regulator continues to encourage their use.
• Do not reuse your master password. The Norton case shows what happens when one leaked password opens a vault.
• Turn on two-step verification for the manager itself. The UK's National Cyber Security Centre (NCSC) says to do this so a criminal who knows your primary password still cannot get in.

The three incidents people mean

Incident	What happened	What was exposed	Was the vault opened?
LastPass, 2022	Two linked attacks on company systems and an employee's home computer	Backup database with encrypted vaults plus unencrypted data such as names, emails, phone numbers and website URLs	The ICO found no evidence the hacker decrypted passwords; some experts later suspected certain stolen vaults were cracked
Norton Password Manager, 2022 to 2023	Credential stuffing: attackers tried username and password pairs bought from the dark web	Accounts whose owners reused passwords, possibly including vault contents	Norton said its systems were not compromised
KeePass, CVE-2023-32784	A software flaw in versions before 2.54	Master password recoverable from a memory dump (first character not recoverable)	Needed access to the computer's memory or files

LastPass: what was actually stolen

The ICO's account of the 2022 breach is the clearest primary source. A hacker first compromised a LastPass employee's corporate laptop and reached the development environment. Then they targeted a senior employee who held decryption keys, got onto that person's personal device through a known vulnerability in a third-party streaming service, and installed a keylogger. That captured the employee's master password, and multi-factor authentication was bypassed with a trusted-device cookie. With the AWS access key and decryption key from the employee's business vault, the attacker extracted the backup database.

That database held personal information, including customer names, emails, phone numbers and stored website URLs, plus copies of customers' encrypted vaults. The ICO said up to 1.6 million UK users were affected and fined LastPass UK Ltd £1,228,283 on 20 November 2025 for failing to apply sufficiently robust technical and security measures.

Two details matter for you. First, the website list was not encrypted, so an attacker could see which services you use, which is useful for targeted phishing. Second, the encrypted vault is only as strong as the master password protecting it. In September 2023, Krebs on Security reported that researchers had tied crypto thefts from more than 150 people, worth over $35 million, to a common factor: the victims had stored their crypto seed phrases in LastPass. Some experts concluded that criminals had likely cracked open some of the stolen vaults. That points to offline guessing against weaker vaults and to people holding very high-value secrets, and it is not proof that long, unique master passwords were broken.

Norton: a credential-stuffing story, not a vault crack

In January 2023, Gen Digital (Norton's parent company) sent breach notices saying an attacker had used username and password pairs obtained elsewhere to log in to Norton accounts from around December 1, 2022. The company detected an unusually large volume of failed logins on December 12 and completed its investigation on December 22. Its notice said: "Our own systems were not compromised." For people who used Norton Password Manager, the notice warned the attacker might have obtained details in their vaults, and that the risk was greatest for anyone whose Norton account password matched their Password Manager master key. Gen later told BleepingComputer it had secured 925,000 inactive and active accounts that may have been targeted.

If you are weighing Norton's own product, see our Norton 360 review. The point here is broader: any account protected only by a reused password can be opened by a stranger.

KeePass: when the flaw is on your own computer

KeePass keeps your database locally, so there is no company vault to steal. The risk was different. The US National Vulnerability Database describes CVE-2023-32784: in KeePass 2.x before 2.54, the cleartext master password could be recovered from a memory dump, even when the database was locked or KeePass was no longer running. The dump could come from a process dump, the swap file, the hibernation file or a RAM dump of the whole system, and the first character could not be recovered. Version 2.54 changed the API usage and added random string insertion as mitigation. An attacker needed access to your machine or its files, which is why malware protection and updates matter as much as the manager itself.

What these hacks have in common

• The weak point was a person or a device, not the encryption: a keylogger on a home PC, a reused password, an out-of-date app.
• Metadata can leak even when passwords do not. Knowing your accounts helps scammers write convincing messages.
• Old and weak vaults are the easy targets. A short master password gives an offline attacker time to guess.

How to lower your risk, in order

1. Make the master password long and unique. CISA suggests at least 16 characters, or a passphrase of four to seven unrelated words, and never reuse it anywhere.
2. Turn on two-step verification for the manager account. Prefer a passkey or authenticator app over text messages.
3. Use passkeys where offered. The NCSC recommends passkeys as the first-choice login wherever a site supports them, with a strong unique password plus two-step verification elsewhere.
4. Keep the manager, browser and operating system updated. The KeePass flaw was fixed in a normal update.
5. Protect the computer. Run reputable security software and avoid pirated downloads, because keyloggers and infostealers target exactly the device where you type the master password.
6. Keep crypto seed phrases out of any password manager unless you accept the risk. Write recovery phrases offline.
7. Check which of your accounts appeared in a breach and change those passwords first, starting with email and banking.

What to do if your manager had a breach

1. Read the provider's notice and check which data was taken, and whether vault data was involved.
2. Change the master password and enable two-step verification, even if the provider says vaults stayed encrypted.
3. If your master password was short, reused or old, rotate the passwords stored inside, starting with email, banking, crypto and work accounts.
4. Watch for phishing that mentions services you use, since URLs and emails may have leaked.
5. If money or identity may be at risk, use our guide on identity theft protection and what you can do free and report scams with the steps in our FTC reporting guide.

Built-in or standalone?

The NCSC says browser and device password managers are safe to use on your own devices and are the easiest way to start, but they are only as secure as your devices and accounts. Third-party managers can sync across mixed browsers and devices. If you are deciding between them, read is Google Password Manager safe, and if a suite bundles a manager, check its limits in our internet security suite comparison before paying.

The bottom line

Password managers get attacked because they hold valuable things, and some providers have failed customers: LastPass was fined for its 2022 security failings. But the documented cases show vault encryption holding up while people, reused passwords and infected computers were the weak points. Keeping a manager, with a unique master password, two-step verification, updates and a protected device, is still safer than the alternative of reusing passwords.

Sources

• ICO: Password manager provider fined £1.2m for data breach (11 December 2025)
• ICO: LastPass UK Ltd monetary penalty notice (20 November 2025)
• Krebs on Security: Experts fear crooks are cracking keys stolen in LastPass breach (September 2023)
• BleepingComputer: NortonLifeLock warns that hackers breached Password Manager accounts (January 13, 2023)
• NIST National Vulnerability Database: CVE-2023-32784
• NCSC: Managing your passwords (reviewed 21 May 2026)
• CISA: Use Strong Passwords