LastPass Data Security Incident Litigation

A federal court authorized the Notice because you have the right to know about the proposed Settlement of this class action lawsuit and about all of your rights and options before the Court decides whether to grant Final Approval of the Settlement. The Notice explains the lawsuit, the Settlement, your legal rights, what benefits are available, who is eligible for them, and how to get them.

The Honorable Patti B. Saris of the United States District Court for the District of Massachusetts is overseeing this class action. The case is known as In re LastPass Data Security Incident Litigation, Case No. 1:22-cv-12047-PBS (D. Mass.) (the “Action”). The people who filed this lawsuit are called the “Plaintiffs,” and the company they sued, LastPass US LP, is called the “Defendant.”

Between August 2022 and November 2022, a cybercriminal conducted an attack against LastPass’s systems, ultimately copying both encrypted and unencrypted backup storage data from LastPass’s cloud-based storage environment (i.e., the “2022 LastPass Data Security Incident” or “Incident”).

Beginning in December 2022, Plaintiffs, on behalf of themselves and proposed classes of similarly situated individuals, began filing class action lawsuits against LastPass. These class action lawsuits were consolidated in the United States District Court for the District of Massachusetts in one consolidated class action lawsuit captioned In re LastPass Data Security Incident Litigation, Case No. 1:22-cv-12047-PBS (the “Action”).

In the Action, Plaintiffs claim that Defendant was responsible for the Incident and that Plaintiffs were injured as a result. Defendant denies these claims and says it did not do anything wrong. No court or other judicial entity has made any judgment or other determination that Defendant has any liability for these claims or did anything wrong. By entering into the Settlement, Defendant is not admitting any wrongdoing.

The fourteen Class Representatives in this case are Amy Doermann, Ayana Looney, Dan LeFebvre, David Andrew, Erik Brook, Glenn Mulvenna, Hui Li, Nathan Goldstein, Noah Bunag, R. Andre Klein, Sarb Dhesi, Steven Carter, Debt Cleanse Group Legal Services LLC, and Hustle N Flow Ventures LLC.

A class action is a lawsuit in which one or more people called the Class Representatives sue on behalf of all people who have similar claims. Together all of these people are called a Settlement Class or Settlement Class Members. One court resolves the issues for all Settlement Class Members, except for those Settlement Class Members who exclude themselves from the Settlement Class.

The Court has not decided in favor of the Plaintiffs or Defendant, and the Action has not gone to trial. Instead, both sides have agreed to the Settlement. The Plaintiffs and Defendant are in favor of the Settlement because a settlement avoids the time, cost, and risk of a trial and related appeals, while providing benefits to the Settlement Class Members. The Class Representatives appointed to represent the Settlement Class and the attorneys for the Settlement Class (“Settlement Class Counsel”) think the Settlement is best for all Settlement Class Members.

If you received an email notice of the 2022 LastPass Data Security Incident and/or notice of this Settlement, you have been identified as a Settlement Class Member. More specifically, the Settlement Class is defined as all natural persons residing in the United States, as well as all companies, entities, and organizations registered to do business in the United States, whose LastPass accounts were allegedly compromised, extracted, copied, stolen, or otherwise exposed as a result of the 2022 LastPass Data Security Incident, and whose accounts contained data at the time of the Incident.

You are a Settlement Class Member, and you are affected by this Settlement, if you fall within the definition of the Settlement Class.

Yes, the Settlement does not include (1) the Court; (2) the Defendant, GoTo Technologies USA, LLC, LMI GP, Inc., Francisco Partners Management, L.P., Francisco Partners Consulting, LLC, Francisco Partners V, L.P., Francisco Partners V-A, L.P., Francisco Partners V-B, L.P., Logan Co-Invest, L.P., Elliott Investment Management L.P., Elliott Associates, L.P., Elliot International, L.P., their officers and directors, and other Released Parties as fully defined in the Settlement Agreement; (3) any individual who timely and validly requests to be excluded from the Settlement Class and the successors or assigns of any such excluded Persons; and (4) any Person found by a court of competent jurisdiction to be guilty under criminal law of initiating, causing, aiding, or abetting the criminal activity occurrence of the Incident, or who pleads nolo contendere to any such charge.

If you are still not sure whether you are a Settlement Class Member, you may review the Settlement Agreement, call the Settlement Administrator at 1-877-748-1875, or email the Settlement Administrator at info@LastPassSettlement.com.

This is a summary of the Settlement benefits.

The Settlement will provide Settlement Class Members with the following benefits:

• In-Kind Relief. Settlement Class Members will receive (1) a complimentary 6-month upgrade to a Consumer Premium Account for existing Settlement Class Members who were Consumer Free Account users at the time of the Incident; and (2) Dark Web Monitoring services for all LastPass users.
• Settlement Fund Benefits. Settlement Class Members may also submit a claim for certain payments or relief, as follows:

  • Statutory Payment. Settlement Class Members with an active Consumer Premium Account, Consumer Family Account, or Business Account and Vault Content may submit a claim for a $25 statutory payment (the “Statutory Payment”).

    OR

  • Cash Payment for Ordinary Loss Relief and Extraordinary Loss Relief. In lieu of submitting a claim for a Statutory Payment, Settlement Class Members with an active Consumer Premium Account, Consumer Family Account, or Business Account and Vault Content may submit a claim for (1) reimbursement of up to $300 per person for documented ordinary losses fairly traceable to the Incident (“Ordinary Loss Relief”); and/or (2) reimbursement of up to $10,000 per person for documented extraordinary losses caused by the Incident (“Extraordinary Loss Relief”).

    AND (FOR CALIFORNIA RESIDENTS)

  • CCPA Statutory Damages. Settlement Class Members who were California residents at the time of the Incident and had any type of LastPass account may submit a claim for $100 statutory damages payment under the CCPA (the “CCPA Statutory Damages”). This benefit is in addition to the $25 Statutory Payment or Cash Payment for Ordinary Loss Relief and Extraordinary Loss Relief that Settlement Class Members may be eligible to receive.
• Crypto Pool Benefits. In addition to seeking Settlement Fund benefits, Settlement Class Members may also seek reimbursement for up to $900,000 in cryptocurrency losses alleged to have been caused by the Incident (i.e., “Cryptocurrency Claimants”). Please read the Notice carefully to understand how you may seek this benefit.

These Settlement benefits will be paid on a pro rata basis, meaning the final amounts may be adjusted based on costs, including attorneys’ fees and expenses and how many individuals submit valid claims.

As a reminder, you are a Settlement Class Member if your LastPass account was allegedly compromised, extracted, copied, stolen, or otherwise exposed as a result of the 2022 LastPass Data Security Incident, and your account contained data at the time of the Incident.

Please see FAQs 9-14 for more details about each benefit.

If you are a Settlement Class Member with a Consumer Free Account at the time of the Incident, you are eligible to receive a complimentary 6-month upgrade to a Consumer Premium Account.

To receive this benefit, you must submit a claim and check the box that you want the 6-month upgrade. If you elect to receive the complimentary upgrade, your LastPass account will automatically be upgraded to a Consumer Premium Account after the Settlement is approved by the Court.

At the end of the 6-month period, Settlement Class Members who elected to receive a complimentary upgrade to a Consumer Premium Account will have their plan restored to a Consumer Free Account by default, unless they affirmatively choose to retain the upgraded Consumer Premium Plan at Defendant’s current plan pricing. There is no requirement that Settlement Class Members provide their credit card or other payment information to receive this benefit.

If you are a Settlement Class Member and currently have a LastPass account, then you will automatically receive Dark Web Monitoring services.

Dark Web Monitoring services provide a way to protect yourself from unauthorized use of your information. LastPass will monitor and notify its users if their personal data has been identified on dark web websites or has been compromised by dark web data leaks.

More information about the Dark Web Monitoring services being provided by LastPass through this Settlement is available at https://www.lastpass.com/features/dark-web-monitoring.

You may qualify for a $25 “Statutory Payment.”

Each Settlement Class Member with a Consumer Premium Account, Consumer Family Account, or Business Account and content in their LastPass vault at the time of the Incident may elect to receive a Statutory Payment. If you elect to receive a Statutory Payment, you cannot receive Ordinary Loss Relief or Extraordinary Loss Relief.

You may qualify for $100 “CCPA Statutory Damages” payment.

Each Settlement Class Member who was a California resident at the time of the Incident and had any type of LastPass account (that is, not limited to a Consumer Premium Account, Consumer Family Account, or Business Account and Vault Content and includes both paid and free LastPass accounts) may elect to receive $100 CCPA Statutory Damages payment if they attest that (1) the claimant was a California resident at the time of the Incident and (2) stored any of the following information in their LastPass vault: (a) a password or security question and/or (b) the claimant’s first name or first initial and the claimant’s last name in combination with any one or more of the following: the claimant’s (i) Social Security number; (ii) driver’s license number, California identification card, Tax Identification Number, passport number, military identification number, or other unique identification number issued on a government document commonly used to verify the identity of a specific individual; (iii) account number or credit card or debit card number, in combination with any required security code, access code, or password that would permit access to an individual’s financial account; (iv) medical information; (v) health insurance information; (vi) unique biometric data generated from measurements or technical analysis of human body characteristics, such as fingerprint, retina, or iris image, used to authenticate a specific individual [unique biometric data does not include a physical or digital photograph, unless used or stored for facial recognition purposes]; or (vii) genetic data.

This CCPA Statutory Damages provision only applies to natural Persons and does not apply to corporations or other business entities. CCPA Statutory Damages are in addition to the $25 Statutory Payment or Cash Payment for Ordinary Loss Relief and Extraordinary Loss Relief that a Settlement Class Member may be eligible to receive.

You may qualify for Ordinary Loss Relief and/or Extraordinary Loss Relief.

In lieu of submitting a claim for a Statutory Payment, Settlement Class Members with an active Consumer Premium Account, Consumer Family Account, or Business Account and Vault Content may submit a claim for (1) reimbursement of up to $300 per Person for documented ordinary losses fairly traceable to the Incident and incurred between August 1, 2022, and the Claim Deadline (“Ordinary Loss Relief”); and/or (2) reimbursement of up to $10,000 per Person for documented extraordinary losses caused by the Incident and incurred between August 1, 2022, and the Claim Deadline (“Extraordinary Loss Relief”).

Ordinary Loss Relief may include compensation for costs for credit monitoring, identity protection, identity restoration, dark web monitoring, security, physical or behavioral health services, or similar services related to the Incident. Extraordinary Loss Relief may include compensation for identity theft, fraud, or similar losses shown to have been caused by the Incident.

Settlement Class Members submitting claims for Ordinary Loss Relief and/or Extraordinary Loss Relief must submit documentation and attestation supporting their claims. This may include receipts or other documentation, not “self-prepared” by the claimant, that document the costs incurred. “Self-prepared” documents such as handwritten receipts are, by themselves, insufficient to receive reimbursement, but may be considered to add clarity or support to other submitted documentation.

Settlement Class Members must also include an attestation that the monetary losses are fairly traceable to (for Ordinary Loss Relief) or caused by (for Extraordinary Loss Relief) the Incident and were not incurred due to some other event or reason.

In addition to seeking Settlement Fund benefits, Settlement Class Members may also seek up to $900,000 in cryptocurrency losses alleged to have been caused by the Incident (“Cryptocurrency Claimants”). Cryptocurrency Claimants will have their claims decided by the court-approved special master, Bruce A. Friedman, Esq. (the “Special Master”), as detailed in Exhibit A of the Settlement Agreement.

The Special Master shall also select a blockchain forensics and cryptocurrency loss expert (“Cryptocurrency Loss Expert”) to assist the Special Master in adjudicating claims submitted by Cryptocurrency Claimants. In the event of Mr. Friedman’s incapacitation or unavailability, Plaintiffs and Defendant will select a replacement neutral party to serve as a special master from JAMS, Inc.

You will have the opportunity to submit documentation supporting your claim to the Special Master through the cryptocurrency claims adjudication process set forth in Exhibit A of the Settlement Agreement. By submitting a claim for cryptocurrency losses, you are agreeing to have the Special Master decide your claim and determine how much, if any, reimbursement you are entitled to receive, up to the $900,000 individual cap and subject to the aggregate cap of $16,250,000. Once this claims review process is complete, the Special Master’s decision will be final.

By participating in this process, you will be unable to file a separate lawsuit against Defendant or the Released Parties to seek to recover cryptocurrency losses alleged to have been caused by the Incident. You are therefore agreeing to the claims process detailed in Exhibit A of the Settlement Agreement and will be bound by the Special Master’s decision.

Defendant has agreed to make cash funds available to pay for all Valid Claims submitted by Cryptocurrency Claimants, subject to an aggregate cap of $16,250,000 (the “Crypto Pool”). The Special Master and Cryptocurrency Loss Expert will provide an estimate of their expected fees and expenses prior to the Opt-Out Deadline and will not be permitted to exceed those costs without further approval from the Court. All valid claims for Crypto Pool benefits will be paid on a pro rata basis from the Crypto Pool after related Settlement Administration Costs, special master fees and expert costs, and Settlement Class Counsel’s apportioned fees and expenses have been paid out of the Crypto Pool.

If you file a claim for cryptocurrency losses, the Court may schedule another hearing to finalize any payments from the Crypto Pool after approving the process as part of the Settlement. You will receive additional information after submitting your claim.

Unless you exclude yourself by “opting out,” you are choosing to remain in the Settlement Class. If the Settlement is approved and becomes final, all the Court’s orders will apply to you and legally bind you. You won’t be able to sue, continue to sue, or be part of any other lawsuit against Defendant or related parties about the legal issues in this Action that are resolved by this Settlement and released by the Class Action Settlement Agreement and Release.

To receive a benefit under the Settlement, you must complete and submit a claim for that benefit using the form available on this website (“Claim Form”). Claim Forms must be submitted online here.

The deadline to complete and submit a Claim Form is July 2, 2026.

The Court will hold a Final Approval Hearing on July 14, 2026, at 2:30 p.m. to decide whether to approve the Settlement. Payments cannot be distributed until after the Court approves the Settlement. However, even if the Court approves the Settlement, there may be appeals from that decision, and resolving those can take time. It also takes time for all the Claim Forms to be processed by the Settlement Administrator and Special Master. In addition, the Court may schedule another hearing after the Final Approval Hearing to approve any payments from the Crypto Pool. Please be patient.

The Settlement Administrator will decide whether and to what extent any claim made on each Claim Form is valid and timely. The Settlement Administrator may require additional information to determine whether a Claim is valid. If you do not provide the additional information in a timely manner, then the Claim will be considered invalid and will not be paid.

For claims submitted for cryptocurrency losses, the Special Master will adjudicate the claims as detailed in Exhibit A of the Settlement Agreement.

If you change your mailing or email address after you submit a Claim Form, it is your responsibility to inform the Settlement Administrator of your updated information. You may notify the Settlement Administrator of any changes by emailing info@LastPassSettlement.com.

Yes, the Court has appointed as Settlement Class Counsel Nathaniel L. Orenstein of Berman Tabacco; Amy Keller of DiCello Levitt LLP; Nicholas A. Migliaccio of Migliaccio & Rathod LLP; Thomas A. Zimmerman, Jr. of Zimmerman Law Offices, P.C.; and James Pizzirusso of Hausfeld LLP; and Michael R. Reese of Reese LLP on behalf of the California subclass, to represent you and the Settlement Class for the purposes of this Settlement.

Claimants may be assisted by class counsel or their own counsel in compiling data to support their individual claims. Class counsel may be reached at classcounsel@lastpasssettlement.com or (312) 214-7900.

You may hire your own lawyer at your own cost and expense if you want someone other than Settlement Class Counsel to represent you in this Action.

Settlement Class Counsel’s fees and expenses shall be paid from the Settlement Fund and deducted from the payment of Valid Claims under the Crypto Pool, subject to Court approval.

Defendant has agreed not to oppose Settlement Class Counsel’s request for fees and expenses, provided that the request does not: (1) seek more than thirty-five percent (35%) of the Settlement Fund; or (2) seek to deduct more than thirty-five percent (35%) of an individual Cryptocurrency Claimant’s Valid Claim.

Class Counsel’s application for attorneys’ fees, expenses, and Service Awards will be made available on the Documents page of this website before the deadline for you to comment or object to the Settlement. You can also download a copy of the application here.

To exclude yourself from the Settlement, you must complete and sign an opt-out request. The opt-out request must identify the case name, In re LastPass Data Security Incident Litigation, Case No. 1:22-cv-12047-PBS (D. Mass.), and must include the following:

1. Your full name, current address, and signature
2. A statement of your desire to be excluded from the Settlement and from the Settlement Class
3. A statement confirming whether you desire to be excluded from the Settlement and the Settlement Class because at the time of the 2022 LastPass Security Incident, you had information stored within your LastPass vault that could be used to access your cryptocurrency assets
4. A statement confirming whether you have reason to believe that your cryptocurrency assets were transferred without your authorization as a result of the 2022 LastPass Security Incident

The opt-out request must be addressed to the Settlement Administrator at the address below and postmarked no later than June 2, 2026.

LastPass Data Security Incident Litigation
Settlement Administrator
P.O. Box 2230
Portland, OR 97208-2230

You cannot exclude yourself online, by telephone, or by email.

No. If you exclude yourself, you are telling the Court that you don’t want to be part of the Settlement. The only way to obtain Settlement benefits is to remain a Settlement Class Member and submit a valid Claim Form.

No. Unless you exclude yourself, you give up any right to sue the Defendant and Released Parties for the claims that this Settlement resolves. You must exclude yourself from this Action to start or continue your own lawsuit or be part of any other lawsuit against the Defendant or any of the Released Parties. If you have a pending lawsuit, consult with your attorney in that case immediately.

If you do not exclude yourself from the Settlement Class, you can object to the Settlement if you do not agree with any part of it. You can give reasons why you think the Court should deny approval by submitting an objection.

To submit a valid objection, you must object in writing, and the objection must state

1. the objector’s full name and address;
2. the case name and docket number (In re LastPass Data Security Incident Litigation, Case No. 1:22-cv-12047-PBS);
3. information identifying the objector as a Settlement Class Member, including proof that the objector is a member of the Settlement Class (e.g., copy of the objector’s Notice, copy of original email notice of the Incident, or a statement explaining why the objector believes he or she is a Settlement Class Member);
4. all grounds for the objection, accompanied by any legal support for the objection the objector believes to be applicable;
5. the identity of any and all counsel representing the objector in connection with the objection;
6. whether the objector and/or his or her counsel will appear at the Final Approval Hearing; and
7. the objector’s signature or the signature of the objector’s duly authorized attorney or other duly authorized representative (if any) representing him or her in connection with the objection.

To be timely, written notice of your objection in the appropriate form must be mailed to the Settlement Administrator at the address below and postmarked no later than June 2, 2026.

LastPass Data Security Incident Litigation
Settlement Administrator
P.O. Box 2230
Portland, OR 97208-2230

You may also file your objection with the Court through the Court’s ECF system, with service on Settlement Class Counsel and Defendant’s Counsel. For all objections mailed to Settlement Class Counsel and Defendant’s Counsel, Settlement Class Counsel will file them with the Court as an exhibit to the Motion for Final Approval.

The Court will hear from any Settlement Class Member who attends the Final Approval Hearing and asks to speak regarding his or her objection, regardless of whether they have complied with the above procedures.

Objecting is informing the Court you do not like something about the Settlement. You can object only if you stay in the Settlement Class (that is, do not exclude yourself). Requesting exclusion is informing the Court you do not want to be part of the Settlement Class or participate in the Settlement. If you exclude yourself, you cannot object to the Settlement.

The Court will hold a Final Approval Hearing on July 14, 2026, at 2:30 p.m. before the Honorable Patti B. Saris, Senior District Court Judge for the United States District Court for the District of Massachusetts, at the John Joseph Moakley U.S. Courthouse, which is located at 1 Courthouse Way, Suite 2300, Boston, Massachusetts 02210 (Courtroom 19, 7th Floor).

At this hearing, the Court will consider whether the Settlement is fair, reasonable, and adequate, and decide whether to grant Final Approval of the Settlement, approve Class Counsel’s application for attorneys’ fees and expenses as well as Service Awards to the Class Representatives. If there are objections, the Court will consider them. The Court will also hear from people who have asked to speak at the hearing.

No. Class Counsel will answer any questions the Court may have. However, you are welcome to attend at your own expense. If you file and mail an objection, you do not have to attend the hearing. As long as you file and mail your written objection on time and as set forth above, it will be considered by the Court.

Yes. The Court will hear from any Settlement Class Member who attends the Final Approval Hearing and asks to speak regarding his or her objection.

If you filed an objection, you should indicate whether you intend to appear in your objection (see FAQ 25). Your objection should state whether it is your intention to appear at the Final Approval Hearing and should identify any witnesses you may call to testify or exhibits you intend to introduce into evidence at the Final Approval Hearing. If you plan to have your attorney speak for you at the Final Approval Hearing, your objection should also include your attorney’s name, address, and phone number.

If you are a Settlement Class Member and you do nothing, you will remain a member of the Settlement Class but will not receive any Settlement benefits. You will also give up rights explained in FAQ 15 and FAQ 24, including your right to start a lawsuit, continue with a lawsuit, or be part of any other lawsuit against the Defendant or any of the Released Parties about the legal issues in this Action and released by the Settlement Agreement.

The Notice summarizes the proposed Settlement. More details are in the Settlement Agreement itself. A copy of the Settlement Agreement is available here. You may also call the Settlement Administrator with questions at 1-877-748-1875.

The Notice is approved by United States District Court for the District of Massachusetts.

DO NOT CONTACT THE COURT DIRECTLY IF YOU HAVE QUESTIONS ABOUT THE SETTLEMENT.

Please contact the Settlement Administrator or Settlement Class Counsel if you have any questions about the Settlement.