LastPass password manager faces class-action lawsuit over recent breach

“By accessing Plaintiff’s and Class members’ Private Information, hackers can simply unlock the stolen vaults using the victims’ respective master passwords, which were likely stored by LastPass and ultimately accessed by the bad actors and wreak financial havoc on the lives of LastPass users like Plaintiff,” reads the lawsuit where the plaintiff is only named as “John Doe.”

The company in its most recent report about the incident had suggested that the hackers can’t access the stolen password vaults since they’d need the master keys for that. But the lawsuit points out that the hackers were still able to copy sensitive information like names, end-user names, billing addresses, email addresses, telephone numbers, IP addresses, which could be used to scam concerned users.

“Not only has this statement not been verified through discovery, but it is also a shameless attempt by LastPass to shift the blame of the Data Breach’s resulting negative impact on Plaintiff and Class members,” the lawsuit argues.

The part about LastPass shifting the blame is in reference to the password manager saying in its statement that “it would be extremely difficult to attempt to brute force guess master passwords for those customers who follow our password best practices.”

Aside from paying up in consumer damages, the class-action lawsuit is also demanding that the court force LastPass implement better security measures.