I have no conclusions on this but kind of like in court, not the best idea to investigate your own personal breach but I get there is little choice for OP. In

I have no conclusions on this but kind of like in court, not the best idea to investigate your own personal breach but I get there is little choice for OP. In my experience "I didn't click on any suspicious link" and similar user denials are exactly why you don't ask them that during incident response, instead you get them to give you all their browsing/download history/content so you can verify that. It could be cookie theft (physical 2fa can't stop that) or consent phishing if they use oauth for their main lastpass login. As soon as this was noticed, disk/memory images should be taken of all devices with lastpass ideally so they can be investigated. I don't know if the victim here uses laspass on their phone for example or by new apps they include new browser extensions or updates to existing apps (supply chain compromise).