> “The threat actor was also able to copy a backup of customer vault data from the encrypted storage container which is stored in a proprietary binary format th

> “The threat actor was also able to copy a backup of customer vault data from the encrypted storage container which is stored in a proprietary binary format that contains both _unencrypted data, such as website URLs_ …” Other threads here have discussed the potential for this collection of sign-up information and URLs to be used for blackmail and to discover hidden services. There is another major problem: mapping these URLs to existing breach dumps. The attacker now has a list of email addresses and associated URLs. From existing breach dumps (haveibeenpwned.com), they can now try all known passwords associated with these email addresses on all of these URLs. Many passwords stored in LastPass are repeat passwords, and they will gain access to many services without any brute force needed. There will be a class action lawsuit for this gross negligence in security and false and misleading documentation and marketing materials. My hope is that LastPass is forced to liquidate all assets and distribute them to their former customers, in addition to being liable for damages and wasted time related to migration to another password managememt solution, not to mention suffering related to any potential blackmail or disclosure of proprietary information.