If you had a LastPass account exposed in the 2022 breach, you can claim $25 cash with no documentation — and users who lost cryptocurrency can seek up to $900,000 from a separate pool.
What Is This Settlement About?
Between August and November 2022, a cybercriminal attacked LastPass's systems and copied both encrypted and unencrypted backup data from the company's cloud storage. If you used LastPass as your password manager, your vault data — including encrypted passwords and unencrypted metadata like website URLs — was potentially exposed. For users who lost cryptocurrency as a result, the consequences were severe.A consolidated class action was filed, and LastPass agreed to settle for a combined total of $24.45 million: an $8.2 million general settlement fund for all class members, plus a separate $16.25 million Crypto Pool specifically for people who lost cryptocurrency. LastPass denied all claims and says it did nothing wrong. The court has not determined liability. Both sides agreed to settle to resolve the claims.
Who Qualifies?
You qualify if you had a LastPass account that was compromised, extracted, copied, stolen, or otherwise exposed as a result of the 2022 breach, and your account contained data at the time. If you received an email from LastPass about the breach or about this settlement, you are a class member.Both individuals and businesses with LastPass accounts are included.
How Much Can You Get?
This settlement has multiple layers of benefits. Here is what is available.$25 Statutory Payment: Every class member with a paid account (Consumer Premium, Consumer Family, or Business) and vault content can claim $25 cash. No documentation required.
OR instead of the $25, you can claim higher amounts with documentation:
Up to $300 for Ordinary Losses: Reimbursement for costs like credit monitoring, identity protection services, or similar expenses that are "fairly traceable" to the breach. You need receipts or documentation (not self-prepared handwritten notes).
Up to $10,000 for Extraordinary Losses: Reimbursement for identity theft, fraud, or similar losses that were "caused by" the breach. You need documentation proving the loss and an attestation connecting it to the LastPass breach.
You choose the $25 OR the documented losses — you cannot get both. But you can get the documented losses AND the California bonus AND the crypto reimbursement if applicable.
$100 Extra for California Residents
If you were a California resident at the time of the breach and you had any type of LastPass account (free or paid), you can claim an additional $100 in CCPA statutory damages. This is on top of whatever other benefit you claim. You must attest that you lived in California at the time and that you stored qualifying personal information in your vault — such as passwords, Social Security numbers, driver's license numbers, financial account numbers, or biometric data.Up to $900,000 for Stolen Cryptocurrency
This is the part that makes this settlement unusual. If you stored crypto wallet keys, seed phrases, or other cryptocurrency access information in your LastPass vault and your crypto was stolen after the breach, you can claim up to $900,000 per person from a separate $16.25 million Crypto Pool.Crypto claims are reviewed by a court-appointed special master (Bruce A. Friedman, Esq.) and a blockchain forensics expert — not the regular settlement administrator. You will need to submit documentation, and the special master will determine what you are owed. The special master's decision is final.
By submitting a crypto claim, you agree to be bound by the special master's decision and give up your right to file a separate lawsuit against LastPass for crypto losses. This is an important tradeoff to understand before filing.
All valid crypto claims are paid pro rata from the Crypto Pool after administration costs, special master fees, expert costs, and class counsel's apportioned fees are deducted.
Free Benefits for Everyone (No Claim Form Needed)
All class members who currently have a LastPass account will automatically receive Dark Web Monitoring services, which alert you if your personal data appears on dark web sites or in data leaks. No claim form is needed for this benefit.If you were a free (Consumer Free) LastPass user at the time of the breach, you can also claim a complimentary 6-month upgrade to a Consumer Premium account. Check the box on the claim form. At the end of the 6 months, your account reverts to free unless you choose to keep premium at regular pricing. No credit card is required for the upgrade.
How Do I File a Claim?
Submit your claim form online at LastPassSettlement.com. The deadline is July 2, 2026.If you are claiming documented losses, include your supporting documentation with your claim. Self-prepared handwritten receipts alone are not sufficient, but they can be included to support other evidence.
An independent third party will review all claims and determine what benefits you are eligible for. Their decision is final.
Important Dates
Claim Deadline: July 2, 2026Opt-Out Deadline: June 2, 2026
Objection Deadline: June 2, 2026
Final Fairness Hearing: July 14, 2026 at 2:30 PM, before Hon. Patti B. Saris (District of Massachusetts)
Frequently Asked Questions
How much can I get from the LastPass settlement?
Multiple benefits are available. All qualifying class members can claim $25 cash (statutory payment). Instead of the $25, you can claim up to $300 for ordinary losses or up to $10,000 for extraordinary losses with documentation. California residents can claim an additional $100 CCPA statutory damages. If you lost cryptocurrency, you can claim up to $900,000 from a separate $16.25 million crypto pool. All class members also get Dark Web Monitoring and free LastPass users get a 6-month premium upgrade.
Who qualifies for the LastPass data breach settlement?
You qualify if you had a LastPass account that was compromised, extracted, copied, stolen, or otherwise exposed as a result of the 2022 data breach (August through November 2022), and your account contained data at the time. If you received an email from LastPass about the breach or about this settlement, you are a class member.
Can I get money for crypto stolen through the LastPass breach?
Yes. A separate $16.25 million Crypto Pool has been established for LastPass users who lost cryptocurrency allegedly because hackers used stolen vault data to access their crypto wallets. You can claim up to $900,000 per person. Claims will be reviewed by a court-appointed special master and blockchain forensics expert. By submitting a crypto claim, you agree to be bound by the special master's final decision.
Do I get $100 extra if I live in California?
Yes. California residents who had any type of LastPass account (free or paid) at the time of the breach can claim an additional $100 in CCPA statutory damages on top of whatever other benefits they claim. You must attest that you were a California resident at the time and that you stored qualifying personal information (such as passwords, SSN, driver's license number, financial account numbers, or biometric data) in your vault.
What was stolen in the LastPass data breach?
Between August and November 2022, a cybercriminal attacked LastPass's systems and copied both encrypted and unencrypted backup storage data from LastPass's cloud environment. This included encrypted password vaults, as well as unencrypted data such as website URLs stored in vaults. Users who had weak master passwords or reused passwords were especially vulnerable to having their vault contents decrypted by attackers.
