The Tool Desk
Outbyte PC Repair FREERepair Windows errors before they cause bigger problemsFix Now →Outbyte Driver Updater FREEFix the driver behind crashes, sound loss and screen glitchesFind Drivers →iTechGuides is reader-supported. When you buy through links on our site, we may earn an affiliate commission. As an Amazon Associate I earn from qualifying purchases. Learn more
Not necessarily. A password-manager breach can expose account details or readable metadata, or let attackers copy encrypted vaults without showing that they decrypted the passwords inside. The 2022 LastPass incident and a separate 2026 Dashlane incident show why “data was stolen” and “saved passwords were readable” are not the same claim—and why encryption does not make every part of a service safe.
What does it mean when a password manager is breached?
“Breached” can describe several different outcomes. Attackers may copy data, see some information in readable form, or obtain encrypted vault files without being shown to have opened them. Which of those happened matters more to your next steps than the word “breach” by itself.
- Copied: Attackers obtained a file or database. This establishes that data left the service, not that they could read every field in it.
- Exposed in readable form: Information that was unencrypted, or otherwise accessible, could be viewed. Metadata such as saved website addresses can reveal sensitive information even when passwords remain encrypted.
- Encrypted vault copied: The attacker has ciphertext, not automatically the original passwords. A stolen vault can still be targeted with offline guesses, so the strength and uniqueness of the master password matter.
- Decrypted: Evidence that attackers actually recovered readable vault contents is a separate and more serious finding. Do not infer it solely from a report that vault backups were stolen.
Encryption protects only the data and steps it actually covers. It does not by itself protect provider infrastructure, sign-in and device-registration flows, user devices, or unencrypted metadata.
What happened in the LastPass breach?
The UK Information Commissioner’s Office (ICO), reporting its investigation in December 2025, described a linked sequence of compromises in 2022. An initial intrusion into part of the development environment yielded information that was later used in a separate attack on cloud storage. The ICO said the company failed to implement sufficiently robust technical and security measures, enabling access to backup data containing personal information relating to up to 1.6 million UK users. That figure is the ICO’s stated UK scope; it does not mean every user’s passwords were decrypted. ICO announcement
#1 Best Overall
- POWERFUL SECURITY KEY: The Security Key C NFC is the essential physical passkey for protecting your digital life from phishing attacks. It ensures only you can access your accounts.
- WORKS WITH 1000+ ACCOUNTS: Compatible with Google, Microsoft, and Apple. A single Security Key C NFC secures 100 of your favorite accounts, including email, password managers, and more.
- FAST & CONVENIENT LOGIN: Plug in your Security Key C NFC via USB-C and tap it, or tap it against your phone (NFC) to authenticate. No batteries, no internet connection, and no extra fees required.
- TRUSTED PASSKEY TECHNOLOGY: Uses the latest passkey standards (FIDO2/WebAuthn & FIDO U2F) but does not support One-Time Passwords. For complex needs, check out the YubiKey 5 Series.
- BUILT TO LAST: Made from tough, waterproof, and crush-resistant materials. Manufactured in Sweden and programmed in the USA with the highest security standards.
According to the ICO’s penalty notice, an attacker captured a senior engineer’s master password using a keylogger and used an exfiltrated trusted-device cookie to bypass multi-factor authentication (MFA). The combined access enabled the attacker to obtain cloud credentials and download backup data. The notice says saved website URLs were not subject to additional encryption and were visible to the threat actor. ICO penalty notice
The ICO found no evidence that the attacker decrypted customers’ encrypted passwords and other credentials. That does not mean nothing sensitive was exposed: personal information and readable metadata were involved, while the regulator’s finding about passwords is specifically that it found no evidence they were decrypted. LastPass’s incident updates likewise described encrypted sensitive vault fields and said master passwords were not among the stolen data. ICO announcement · LastPass March update
The ICO announced a £1.2 million fine in December 2025; its enforcement listing gives the exact penalty as £1,228,283, issued on 20 November 2025. ICO announcement · ICO enforcement listing
Rank #2
- Requires 3 "AAA" batteries (included)
- Unit auto-locks for 30 minutes after 5 consecutive incorrect PINs
What happened in Dashlane’s 2026 incident?
Dashlane described a different route into the problem. In an advisory published in June 2026, the company said an external party began targeting its account device-registration flow on 31 May by attempting to brute-force verification tokens. Dashlane said attackers obtained valid tokens, registered devices, and downloaded encrypted vaults belonging to fewer than 20 personal-plan customers. It said the affected users were notified directly, its investigation found no additional impact or evidence of internal-system compromise, and it added network and product protections. These are Dashlane’s statements about its investigation. Dashlane security advisory
Dashlane said the copied vaults required the user’s master password to decrypt. On 3 September 2026, the company reported deploying additional verification layers for new-device registration and described broader platform hardening. Those updates do not establish that all account systems or future attacks are immune; they describe the response and investigation Dashlane reported for this incident. Dashlane security advisory
How do the two incidents differ?
| Incident | Attack path described | What was reported exposed or copied | What investigators or the provider said about decryption |
|---|---|---|---|
| LastPass, 2022; ICO findings published in 2025 | Linked development-environment and cloud-storage compromises; a senior engineer’s compromised personal computer and trusted-device cookie were part of the later access path, according to the ICO. | Backup data with personal information and metadata, including saved website URLs, which the ICO said were visible. Up to 1.6 million UK users’ personal information was within the ICO’s stated scope. | The ICO found no evidence that encrypted passwords and other credentials were decrypted. |
| Dashlane, attack beginning 31 May 2026; advisory in June 2026 | Attempts to brute-force verification tokens in the account device-registration flow. | Dashlane said encrypted vaults of fewer than 20 personal-plan customers were downloaded. | Dashlane said the copied vaults required the user’s master password to decrypt; its investigation found no additional impact or evidence of internal-system compromise. |
The cases are not interchangeable: LastPass involved access to backup storage after linked compromises, while Dashlane described abuse of new-device registration. Neither supports a blanket claim that every stored password was exposed, or that encryption prevents every breach consequence.
Why can a stolen encrypted vault still matter?
When an attacker has a copy of an encrypted vault, they may try guesses against it offline rather than repeatedly signing in to the live account. A long, unique master password makes guessing harder; a weak or reused one raises the risk. LastPass warned that weaker master-password settings could reduce the effort needed to guess. LastPass incident notice
PC Slower Than It Used to Be?
A free scan shows the junk files, broken settings and background clutter dragging Windows down - then fixes them in one click.Free scan · Windows 10 & 11Outdated Drivers Are Slowing You Down
One free scan finds every outdated or missing driver and matches the right update for your exact hardware.Free scan · exact hardware match“Zero knowledge” or end-to-end encryption describes an intended relationship between the provider, the user’s secret, and the vault. It is not a promise that every data field is encrypted, that no one can copy ciphertext, or that every endpoint and account flow is secure. In LastPass’s case, the ICO’s finding about encrypted credentials coexisted with its finding that saved URLs were visible. For Dashlane, the company said the downloaded vaults remained encrypted and needed the user’s master password. These findings apply to the incidents described, not to every implementation or future attack. ICO penalty notice · Dashlane security advisory
What should you do after hearing about a password-manager breach?
Use the provider’s notice and the specific exposure details to decide what to change. A report of copied encrypted vaults is not, by itself, a reason to assume every saved password was read.
Rank #4
- FIDO-ONLY FUNCTIONALITY: Supports FIDO2 (passkeys) and FIDO U2F protocols for passwordless and second-factor authentication. Does not support OTP, TOTP, Smart Card (PIV), or other advanced features - upgrade to YubiKey 5 Series for extended functionality
- SECURE AND CONVENIENT: Passwordless MFA login with the YubiKey Bio authenticator and biometric information using a fingerprint, with a PIN as a fallback. Simply plug in via USB and use your fingerprint to authenticate
- DEVICE & OS COMPATIBILITY: Compatible with Windows, macOS, ChromeOS, and Linux. Works seamlessly with supported services like Google and Microsoft accounts, and major password managers. See the full compatibility list at "Works With YubiKey"
- DURABLE & RELIABLE: Resistant to tampering, water, and crushing. No batteries or network connectivity required, offering dependable authentication without any downtime. Securely manufactured in USA & Sweden
- Yubico Authenticator App - Fingerprint enrollment, passkey management and PIN configuration available via the app app - Upgrade to YubiKey 5 Series to generate one-time-passwords (OTP) via Yubico Authenticator and for advanced compatibility (OATH, PIV)
- Check whether your account was identified as affected. Read a direct provider notification and its current incident advisory. Dashlane said it directly notified the small group whose vaults were copied and reported no identified impact to other users in that event. Be alert to phishing messages pretending to be breach notices.
- Review trusted and registered devices. Remove any device you do not recognize, and enable an MFA method supported by your account. MFA can help protect sign-in, but cannot retrieve data already copied or guarantee protection against every recovery or device-registration weakness. Dashlane account guidance
- Assess your master password. If it is short, reused elsewhere, or may have been captured or phished, change it to a long, unique secret and follow the provider’s incident-specific instructions. A master-password change does not erase copies an attacker already obtained.
- Change the affected stored passwords when warranted. Prioritize credentials the provider says were exposed, accounts showing suspicious activity, and any login whose password you reused or suspect was compromised. Do not reset every saved password automatically when the incident evidence and provider guidance do not indicate that all were exposed. LastPass incident notice · Dashlane security advisory
- Secure the devices and email account tied to your vault. If you suspect malware, a keylogger, or account takeover, use a trusted device to update operating-system and security software, remove suspicious access, and secure the email account used for recovery. Change credentials that may have been exposed from that device.
What should you look for when assessing a password manager?
These incidents do not establish a comprehensive ranking of password managers. To evaluate a service, look beyond a “zero knowledge” label and ask how its design handles the points below. A published certification or assessment is useful evidence, but check what systems and dates it actually covers.
- Vault and metadata protection: Which fields are encrypted, and what account or usage details may remain visible?
- Key derivation and recovery: How is the master secret used to protect vault keys, and what happens if you lose access?
- New-device enrollment and MFA: How are devices verified, and what recovery paths can bypass routine sign-in controls?
- Assessment scope and recency: Read the scope and date of independent audits or certifications rather than treating a badge as proof of invulnerability.
- Incident communication and data controls: Check how the service notifies affected users and what export or deletion options it provides.
For examples of vendor documentation, Bitwarden’s security FAQs describe its encryption and security approach, while 1Password’s security assessments page lists assessments and certifications with stated scope and dates. Those pages are starting points for evaluating their claims, not a like-for-like independent ranking.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
