Affected by This LastPass Breach? How to Get a Cut of the $24.5M Settlement

LastPass could owe you $25 as part of a settlement over a 2022 breach.

After a US court certified the preliminary agreement in February, notifications about the $24.5 million settlement started going out on Friday

(Credit: PCMag)

LastPass agreed to the settlement following a wave of class-action lawsuits over a hacker stealing a copy of customers’ encrypted password data, which then paved the way for attackers to break into numerous cryptocurrency wallets. 

The breach ensnared all customer vault data, so anyone who used LastPass prior to November 2022 should be eligible for a payout. Affected users can file a claim at lastpasssettlement.com. But using it to submit an online claim requires a “Unique ID and PIN,” which can only be received through the email notice. 

“If you did not receive an Email Notice or have lost yours, please contact the Settlement Administrator at 1-877-748-1875 for assistance,” the site says. 

(Credit: Lastpasssettlement.com)

Approximately $8.2 million of the fund will be used to distribute a $25 statutory payment. Users based in California can receive an additional $100 for statutory damages under the state’s privacy law. Users can also submit a claim for “reimbursement of up to $10,000 per person” if the breach resulted in an extraordinary loss. 

A larger $16.25 million fund is meant to cover cryptocurrency-related losses from the hack and can award up to $900,000. However, the final settlement amounts all depend on how many claims are filed. 

Despite the offer, some users are already wondering if the settlement website is legit. It’s an understandable concern, given that cybercriminals can quickly create lookalike websites and emails to trick potential victims. But there are several concrete signs that the lastpasssettlement.com site is the real deal. 

(Credit: PACER)

A document from the US court notes that Epiq Systems has been appointed as the administrator of the settlement. If you look up the lastpasssettlement.com domain, you’ll find it’s been registered to Epiq Systems.

The email notification about the settlement also comes from a domain owned by Epiq. Messages to the settlement site will also appear to return replies from an Epiq Systems email server. 

(Credit: GoDaddy.com)

Affected users must submit a claim by July 2 to receive their share of the funds. The court is scheduled to hold a final hearing clearing the settlement on July 14. Users can also exclude themselves from the settlement to pursue their own lawsuit if they submit an opt-out by June 2.

LastPass also reached out to PCMag, and said: "While we continue to deny the alleged claims, we have agreed to a settlement to avoid the ongoing distraction and uncertainty of protracted litigation. Our focus remains on serving our customers, and over the last four years we have made substantial investments across our people, processes and technology, so that we can continue to build and keep trust in LastPass."