I read the customer update, and the severity of this breach is hidden deep in the statement and skimmed over.
Basically: LastPass just shared which sites you have logins for with the attacker. This could be sold or released to the entire world. They claim the usernames are encrypted fields but often the usernames can also be in the URLs saved along with the site.
So check your statements and see. I'm curious to know how many more people this has happened to.
With a whole host of alternate, compatible, implementations:
https://www.pwsafe.org/relatedprojects.shtml
Allowing for self-hosting (and in a few instances, some 'syncing').
Example article: https://dev.to/rusty_sys_dev/switching-to-keepass-and-syncth...
I wouldn't recommend Keypass to my non-technical family and friends, but if you love the command line it might be what you are looking for
If anything, apart from leaking the domain, which could still be a privacy issue, they should have at least sanitized the URLs to remove usernames or tokens if they were going to automatically save those URLs to the vault. I can guess that not doing so allowed their auto-login function to work on some websites by saving the login URL endpoint, but all I'd really want is the vault to keep the sanitized domain.
[0]: https://github.com/cfbao/lastpass-vault-parser/wiki/LastPass...
Someone is out there using whatever data or metadata was unencrypted.
