This settlement resolves claims that the 2022 LastPass breach exposed customer vault data, with $25 cash for account holders and a separate pool for stolen cryptocurrency. The July 2, 2026 claim deadline has passed, and the case is now waiting on the court's final approval decision.
Current Status
Claims are closed. The deadline to file was July 2, 2026, and the opt-out and objection deadline was June 2, 2026. The final approval hearing was held July 14, 2026 before Hon. Patti B. Saris in the U.S. District Court for the District of Massachusetts, but no final approval order had been located as of August 7, 2026, and no payment date had been announced as of that date. If you already filed a claim, there is nothing further to do — the settlement administrator and, for cryptocurrency claims, the court-appointed special master review claims after the court rules.What Is This Settlement About?
Between August and November 2022, a cybercriminal attacked LastPass's systems and copied both encrypted and unencrypted backup data from the company's cloud storage. If you used LastPass as your password manager, your vault data — including encrypted passwords and unencrypted metadata like website URLs — was potentially exposed. For users who lost cryptocurrency as a result, the consequences were severe.A consolidated class action was filed, and LastPass agreed to settle for a combined total of $24.45 million: an $8.2 million general settlement fund for all class members, plus a separate $16.25 million Crypto Pool specifically for people who lost cryptocurrency. LastPass denied all claims and says it did nothing wrong. The court has not determined liability. Both sides agreed to settle to resolve the claims.
Who Qualifies?
You qualify if you had a LastPass account that was compromised, extracted, copied, stolen, or otherwise exposed as a result of the 2022 breach, and your account contained data at the time. If you received an email from LastPass about the breach or about this settlement, you are a class member.Both individuals and businesses with LastPass accounts are included.
What the Settlement Pays
This settlement has multiple layers of benefits. Here is what was available to class members who filed before the July 2, 2026 deadline.$25 Statutory Payment: Every class member with a paid account (Consumer Premium, Consumer Family, or Business) and vault content could claim $25 cash. No documentation required.
OR instead of the $25, a class member could claim higher amounts with documentation:
Up to $300 for Ordinary Losses: Reimbursement for costs like credit monitoring, identity protection services, or similar expenses that are "fairly traceable" to the breach. You need receipts or documentation (not self-prepared handwritten notes).
Up to $10,000 for Extraordinary Losses: Reimbursement for identity theft, fraud, or similar losses that were "caused by" the breach. You need documentation proving the loss and an attestation connecting it to the LastPass breach.
The $25 and the documented losses were alternatives — a class member could not get both. The documented losses, the California payment, and the crypto reimbursement could be combined where all three applied.
$100 Extra for California Residents
California residents at the time of the breach who had any type of LastPass account (free or paid) could claim an additional $100 in CCPA statutory damages, on top of whatever other benefit they claimed. The claim required an attestation of California residency at the time and that qualifying personal information was stored in the vault — such as passwords, Social Security numbers, driver's license numbers, financial account numbers, or biometric data.Up to $900,000 for Stolen Cryptocurrency
This is the part that makes this settlement unusual. Class members who stored crypto wallet keys, seed phrases, or other cryptocurrency access information in a LastPass vault and had crypto stolen after the breach could claim up to $900,000 per person from a separate $16.25 million Crypto Pool.Crypto claims are reviewed by a court-appointed special master (Bruce A. Friedman, Esq.) and a blockchain forensics expert — not the regular settlement administrator. You will need to submit documentation, and the special master will determine what you are owed. The special master's decision is final.
By submitting a crypto claim, you agree to be bound by the special master's decision and give up your right to file a separate lawsuit against LastPass for crypto losses. This is an important tradeoff to understand before filing.
All valid crypto claims are paid pro rata from the Crypto Pool after administration costs, special master fees, expert costs, and class counsel's apportioned fees are deducted.
Free Benefits for Everyone (No Claim Form Needed)
All class members who currently have a LastPass account will automatically receive Dark Web Monitoring services, which alert you if your personal data appears on dark web sites or in data leaks. No claim form is needed for this benefit.Free (Consumer Free) LastPass users at the time of the breach could also claim a complimentary 6-month upgrade to a Consumer Premium account by checking the box on the claim form, which is now closed. At the end of the 6 months, the account reverts to free unless the user keeps premium at regular pricing. No credit card is required for the upgrade.
Can I Still File a Claim?
No. The claim deadline was July 2, 2026 and the claim form is closed at LastPassSettlement.com. New claims are no longer being accepted.If you filed before the deadline, an independent third party reviews all claims and determines what benefits you are eligible for. Their decision is final. Cryptocurrency claims go to the court-appointed special master instead of the regular administrator.
Payments cannot be distributed until the court approves the settlement, and any appeal from that decision would add further time. For the current status of your claim, check the official settlement website.
Important Dates
Claim Deadline: July 2, 2026 (passed)Opt-Out Deadline: June 2, 2026 (passed)
Objection Deadline: June 2, 2026 (passed)
Final Fairness Hearing: July 14, 2026 at 2:30 PM, before Hon. Patti B. Saris (District of Massachusetts) — held; no ruling located as of August 7, 2026
Frequently Asked Questions
Can I still file a LastPass settlement claim?
No. The claim deadline was July 2, 2026 and the claim form is closed. The final approval hearing was held July 14, 2026, but no final approval order had been located as of August 7, 2026 and no payment date had been announced. If you filed before the deadline, your claim is being processed and there is nothing further for you to do.
How much can I get from the LastPass settlement?
Multiple benefits are available. All qualifying class members can claim $25 cash (statutory payment). Instead of the $25, you can claim up to $300 for ordinary losses or up to $10,000 for extraordinary losses with documentation. California residents can claim an additional $100 CCPA statutory damages. If you lost cryptocurrency, you can claim up to $900,000 from a separate $16.25 million crypto pool. All class members also get Dark Web Monitoring and free LastPass users get a 6-month premium upgrade.
Who qualifies for the LastPass data breach settlement?
You qualify if you had a LastPass account that was compromised, extracted, copied, stolen, or otherwise exposed as a result of the 2022 data breach (August through November 2022), and your account contained data at the time. If you received an email from LastPass about the breach or about this settlement, you are a class member.
Can I get money for crypto stolen through the LastPass breach?
Yes. A separate $16.25 million Crypto Pool has been established for LastPass users who lost cryptocurrency allegedly because hackers used stolen vault data to access their crypto wallets. You can claim up to $900,000 per person. Claims will be reviewed by a court-appointed special master and blockchain forensics expert. By submitting a crypto claim, you agree to be bound by the special master's final decision.
Do I get $100 extra if I live in California?
Yes. California residents who had any type of LastPass account (free or paid) at the time of the breach can claim an additional $100 in CCPA statutory damages on top of whatever other benefits they claim. You must attest that you were a California resident at the time and that you stored qualifying personal information (such as passwords, SSN, driver's license number, financial account numbers, or biometric data) in your vault.
What was stolen in the LastPass data breach?
Between August and November 2022, a cybercriminal attacked LastPass's systems and copied both encrypted and unencrypted backup storage data from LastPass's cloud environment. This included encrypted password vaults, as well as unencrypted data such as website URLs stored in vaults. Users who had weak master passwords or reused passwords were especially vulnerable to having their vault contents decrypted by attackers.
