LastPass
LastPass Data Breach Settlement
The LastPass settlement resolves allegations that the company failed to protect accounts affected by its 2022 data security incident. Eligible U.S. account holders and organizations could seek cash or other benefits, with separate review of cryptocurrency losses. Claims closed on July 2, 2026, and the court granted final approval on September 30, 2026.
Key facts
If you filed a LastPass settlement claim, the case has reached final approval. The court approved the settlement on September 30, 2026. The July 2, 2026 claim deadline has passed, and the online claim form is closed.
The lawsuit alleges that LastPass failed to protect users affected by the August through November 2022 data security incident. LastPass denies wrongdoing, and the settlement is not a finding of liability.
The settlement includes an $8.2 million fund and a separate cryptocurrency-loss pool capped at $16.25 million. These are not amounts promised to individual claimants. Fees, administration costs, eligibility rules, and the number of approved claims affect payments.
Qualifying paid-account holders with vault content could choose a $25 statutory payment instead of documented-loss benefits. Those loss benefits provide up to $300 for ordinary losses and up to $10,000 for extraordinary losses under the settlement rules. Eligible California residents could also seek a $100 statutory benefit. Cash amounts are subject to adjustment under the allocation rules.
Validated cryptocurrency-loss claims have a separate review process and an individual cap of $900,000, subject to the shared pool and deductions. Certain free-account users could request a six-month Premium upgrade, and the settlement also provides dark web monitoring for current class-member account holders.
Final approval does not mean every claim has been approved or paid. As of October 15, 2026, the administrator has not posted a confirmed distribution date in its current status update. Cryptocurrency claims may require further review and court proceedings.
Who may qualify
The class covers U.S.-resident natural persons and entities registered to do business in the United States whose LastPass accounts contained data and were allegedly compromised or exposed in the 2022 incident, subject to the notice exclusions. Benefits depend on account type, California residency, and approved losses. Timely claims were due July 2, 2026; new claims are closed.
What proof do you need?
Did this settlement need proof of purchase?
For this settlement, you needed proof for some claims but not others. Requirements varied by benefit. Ordinary and extraordinary loss claims required supporting documents and attestations. California statutory claims required residency and qualifying vault-content attestations. Cryptocurrency claims require validation through the special-master process. The $25 statutory option did not require proof of financial loss, but account and eligibility conditions still applied. New claims are closed. The claim window for this settlement has closed.
Where do these requirements come from?
From the official settlement notice - the document that sets out who qualifies and what they have to provide. Claim summarizes it; Claim does not set it. Where the notice and this page disagree, the notice is the one that counts.
How can I check a settlement email or text?
Who is the administrator?
Epiq is the settlement administrator: the company a court appoints to run the claims process, send notices and make payments. It is not the company being sued, and it is not Claim.
Is the sender's name enough to trust the message?
No. A sender name, a display name, a reply-to address and even a case number can all be copied. Check the case name and number in the message against the ones on this page, and reach the court-authorized settlement website yourself rather than through a link or button in the message.
What warning signs should I look for?
Any request for a fee, a payment or a wire to release settlement money. Any request for full banking login details. Pressure to act straight away. A web address that does not match the one in the official notice. Genuine notices identify the case by name and number and explain how payment is made, sometimes offering a payment election such as a check, a digital payment or a virtual card.
The claim window for this settlement has closed. You can still see which settlements are accepting claims now.
Browse open settlements
