There’s probably a copy of your LastPass data breach vault sitting on an attacker’s server right now. Maybe. But if you source from China and haven’t changed a single password since December 2022, you should assume it. The breach disclosed that month wasn’t a near miss: attackers copied encrypted customer vaults out of LastPass’s cloud storage, along with unencrypted metadata showing exactly which platforms you use. Every Alibaba login, 1688 account, freight-forwarder portal, and supplier contact saved since 2015 could be in that haul.

Treat every password in it as burned. Below I’ll cover what was actually taken, why importers get hit harder than ordinary users, and the exact fix sequence. It starts tonight.

What the LastPass Data Breach Actually Exposed (Timeline)

LastPass got hit twice. The company’s own disclosures show how one small compromise snowballed into a full vault theft:

  • August 2022: An intruder compromised a single developer account and spent 4 days inside the development environment. Source code and technical documentation went out the door.
  • November 30, 2022: LastPass admitted the same attacker used that first break-in to reach a third-party cloud storage service.
  • December 22, 2022: The company confirmed the attacker copied a backup containing customer vault data.

The vaults themselves were encrypted with 256-bit AES, keyed to each user’s master password. LastPass never stores that key, so cracking isn’t trivial. The unencrypted data, though, was a goldmine: account email addresses, phone numbers, billing addresses, the IP addresses customers logged in from, and (this is the part that matters to you) every URL saved inside those vaults. A leaked URL list reads like a map of your entire sourcing operation.

It was also the second major incident since 2015, when attackers made off with user email addresses and password reminders. Twice in seven years. That pattern should weigh on anyone deciding where to keep trade credentials long-term.

Why the LastPass Breach Hits China Sourcing Teams Hardest

Password managers leak more than passwords. They leak relationships.

Because the vault URLs were stored in plain text, anyone holding your stolen backup can read a list of the exact Alibaba storefronts, 1688 supplier pages, inspection portals, and freight platforms you depend on. That’s a ready-made target list for business email compromise (BEC), the most expensive scam in international trade. The FBI’s Internet Crime Complaint Center logged $2.9 billion in BEC losses across 21,442 complaints in 2023. That works out to roughly $137,000 per victim, and supplier impersonation is the most common version of it.

Picture how it plays out. Your stolen vault shows a supplier portal you’ve used since 2019. Three weeks later, an email arrives from that vendor’s lookalike domain announcing a new beneficiary bank for your next deposit. You’re about to wire 30% of a $150,000 order, $45,000, and the message cites the real PO number, the shipping window, even the product SKUs. All of it came from your metadata. Buyers who phoned to verify caught the scam. Buyers who trusted the email lost the deposit, because funds that move through mule accounts almost never come back.

For a small importing business on 20% margins, one $45,000 hit erases the profit from $225,000 in sales. One wire, and the year’s margin is gone.

Your 7-Step Recovery Plan After the LastPass Data Breach

Work through these in order. The sequence matters because attackers go for recovery paths first:

  • 1. Reset the master password now. Sixteen characters minimum. If yours is under 12 or reused anywhere else, assume it can be brute-forced offline against the stolen backup file.
  • 2. Check your PBKDF2 iterations. Account Options, then Advanced. Vaults created before 2018 often sit at the old 30,000-iteration default; OWASP now recommends 600,000+. Raising the number re-encrypts your vault and multiplies an offline cracker’s workload by roughly 20x. Honestly, this setting is buried, and most people never touch it. That’s exactly why it matters.
  • 3. Rotate credentials by blast radius. Start with your primary email (it resets everything else), then banking and payment tools like Wise and PayPal, then trade platforms (Alibaba, 1688, Made-in-China), then freight and inspection portals, then the rest. A 60-entry vault takes about 90 minutes if you batch it in one sitting. Tedious? Yes. Cheaper than a lost deposit? Also yes.
  • 4. Turn on app-based MFA everywhere. Authenticator apps, not SMS. SIM swaps are standard preparation for wire-fraud attacks.
  • 5. Purge dangerous vault notes. Search your vault for IBAN, SWIFT, beneficiary, and account number. Full wire instructions stored as notes are a jackpot if the file is ever cracked. Replace them with a pointer to a verified offline protocol instead.
  • 6. Send suppliers a payment-verification protocol. One short email stating that any bank-detail change gets confirmed only by calling a number already on file. Never a number or link inside the change request itself.
  • 7. Audit shared access. Remove every ex-employee, freelancer, and former agent from shared folders. Any vault shared since 2022 duplicated the exposure.

Costly Mistakes We See Importers Make After the LastPass Breach

In our experience reviewing compromised buyer accounts, most of the damage traces back to a few avoidable errors:

  • Changing only the master password. The stolen backup is frozen in time, but if attackers crack it next year, every old password inside is exposed. Rotating what’s inside the safe matters more than swapping the front door.
  • Trusting default iteration counts. A multi-GPU rig can test billions of raw SHA-256 hashes per second. At 30,000 PBKDF2 iterations, an 8-character master password won’t survive long against hardware like that. The default is not your friend. Check the number yourself.
  • Verifying bank changes over email. If the confirmation loop for a payment change lives in the same channel as the change request, a BEC attacker wins by default. Pick up the phone. Call the number you already have on file.

One more thing, and I’ll be blunt: after two breaches in seven years, we’ve stopped recommending LastPass for trade credentials at SimpleChinaSourcing. Migrate once you’ve finished rotating. And whichever manager you land on, the seven steps above still apply, because any vault is only as strong as its weakest setting. Do all seven, and frankly, you’ll be in better shape than most buyers we talk to.