>> The cloud storage service accessed by the threat actor is physically separate from our production environment. > Is that supposed to be reassuring, consider

>> The cloud storage service accessed by the threat actor is physically separate from our production environment. > Is that supposed to be reassuring, considering that the cloud storage in question apparently had a copy of all the LastPass data? Or is this maybe an attempt to shift the blame: “It wasn’t our servers that the data has been lifted from”? Wow, seriously, they are really good at this. If not for this explanation, I would totally thought only testing environment got accessed.