It was very bad. It was bad that servers of a popular password manager with millions of users were compromised. The security controls were bad: a lastpass engi

It was very bad. It was bad that servers of a popular password manager with millions of users were compromised. The security controls were bad: a lastpass engineer had access to critical credentials in the same machine that he watches Plex open to internet (and possibly more). It was bad because a lot of users don’t have strong master passwords, and their vaults are at risk. Also, insufficient pbkdf2 iterations did not protect well against brute forcing the vault. Sure users should use strong master passwords as much as possible. But a weak password would not have been a problem if the servers had not been compromised. It was bad because a lot metadata has been leaked, that can be useful in further attacks. A compromised server could also push a malicious update to the users and steals master passwords.