UK ICO fines LastPass £1.2 million after 2022 breach affecting 1.6 million UK users

The UK Information Commissioner’s Office (ICO) fined LastPass UK Ltd £1.2 million over a 2022 security breach, which impacted around 1.6 million company users in the UK. The ICO concluded that LastPass did not have sufficiently strong technical and organizational safeguards in place. The breach exposed personal details and encrypted vaults.

The alarming irony of seeing a company that aims to protect people’s data fined for a security breach does not escape the many reports on this incident. For a company like LastPass, reputational damage from a data breach is particularly significant.