# LastPass 2022: backup access can be the production-data incident

Source: https://www.web3sec.news/blog/lastpass-vault-backups
Updated: 2026-11-08

Assign owners and record supporting evidence in your team's own system.

- [ ] Inventory production data copied into backups and development systems.
- [ ] Map storage access and decryption authority separately.
- [ ] Separate privileged work from personal-device risk.
- [ ] Replace underlying secrets at the services that accept them.
- [ ] Test synthetic backup read, decrypt, deletion and alert paths.

## References
- [LastPass: notice of security incident, 22 December 2022](https://blog.lastpass.com/posts/notice-of-recent-security-incident)
- [LastPass: investigation update, 1 March 2023](https://blog.lastpass.com/posts/security-incident-update-recommended-actions)