> Unless @gregsadetsky had his computer access full hacked. He stored the LastPass password in KeePass, right? KeePass has had vulnerabilities allowing JavaScr

> Unless @gregsadetsky had his computer access full hacked. He stored the LastPass password in KeePass, right? KeePass has had vulnerabilities allowing JavaScript on any web page read secrets from the KeePass storage. I'm not saying that's what happened, but I don't think it's safe to say that "had his computer access full hacked.". There's also plenty of NPM packages and similar which has had vulnerabilities which could have extracted passwords from whatever storage is used. Then it doesn't matter if the account was dead or not. Also, it's not safe to say that "there must be a software all these victims have in common". An attacker can specialize in LastPass and may have purchased several credential lists right? Maybe some credentials were extracted via some vulnerable NPM library, maybe some via KeePass vuln, maybe some from password stuffing. We're just speculating here, but I think what you're saying is a bit too definitive based on what we know so far. To me, LastPass seems a bit like a mess so I would not be surprised if they are to blame though.