Wasn't that because they had backed up their password vaults to LastPass' cloud service?
I use KeePass, never upgrade it, and only back it up to my own cold spinning drives. If malware stole my local vault I'd be in trouble, but it's more convenient than keeping my passwords on paper.
