LastPass Data Breach Settlement: Payout Status 2026

At a glance

Status

Pending final approval

Defendant

LastPass US LP

Settlement fund

$8,200,000

Claim deadline

July 2, 2026

No-proof cash option

Yes — $25 flat Statutory Payment (no documentation, requires active Consumer Premium/Family/Business account with vault content at time of incident) OR, in lieu of it, documented Ordinary/Extraordinary Loss Relief; CA residents may additionally claim $100 CCPA Statutory Damages, or up to $300 Ordinary Loss Relief + up to $10,000 Extraordinary Loss Relief (documented, general fund); separately, cryptocurrency losses reimbursed up to $900,000 per individual claimant, subject to an aggregate $16,250,000 Crypto Pool cap, adjudicated by a court-appointed Special Master (Bruce A. Friedman, Esq.) and itself subject to a further pro rata reduction after Special Master/expert fees

Max documented payout

$300

Official site

www.lastpasssettlement.com

Court

United States District Court for the District of Massachusetts (Hon. Patti B. Saris)

Case number

1:22-cv-12047-PBS

Last verified July 24, 2026

Key dates

Milestone	Date	What it means
Claim deadline	July 2, 2026(passed)	Last day to file for a payment
Opt-out (exclusion) deadline	June 2, 2026(passed)	Last day to leave the settlement and keep the right to sue
Objection deadline	June 2, 2026(passed)	Last day to object to the terms
Final approval hearing	July 14, 2026(passed)	When the judge decides whether to approve the settlement
Expected payout	Not yet scheduled	Payments are not sent until after final approval and any appeals

Where to file

The only place to file is the official settlement website:

Verify on the official site

www.lastpasssettlement.com

Filing is free. No legitimate settlement charges a fee to file a claim.

You cannot file on RecordingLaw.com. We are an independent publisher, not the settlement administrator, and we are not affiliated with any court, agency, or defendant.

What Happened

LastPass, the password manager, disclosed in 2022 that intruders had breached its systems and ultimately copied data from cloud-based backup storage, including many customers' encrypted vaults. That vault data is the reason this breach worries people more than a typical breach does: a LastPass vault can hold saved website passwords, and for some users, secrets like cryptocurrency wallet seed phrases or private keys.

Plaintiffs in the resulting lawsuits allege that some class members later had cryptocurrency stolen after their encrypted vaults were cracked using information taken in the 2022 incident. That is an allegation, not a proven fact for every class member, but it is the reason this settlement has an entire separate payment track just for crypto losses.

The consolidated case, In re LastPass Data Security Incident Litigation, case number 1:22-cv-12047-PBS, is before Judge Patti B. Saris in the U.S. District Court for the District of Massachusetts. Fourteen named plaintiffs represent the class. LastPass has not admitted wrongdoing; it agreed to settle to resolve the claims.

The settlement site does not state an exact number of people in the class. If you are unsure whether you are covered, the class definition is broad on paper but specific in practice: it turns on whether LastPass has records showing your account was allegedly compromised and had vault content stored at the time, not on whether you personally noticed anything unusual.

Where the Settlement Stands Right Now, and Why You Have Not Been Paid

As of July 16, 2026, this settlement is pending final approval. It has not been paid out, and it is not finished.

The court held the final approval hearing on July 14, 2026, where Judge Saris heard arguments on whether the settlement is fair and should be approved. As of this writing, two days later, the court has not entered a final approval order. A hearing being held is not the same as a ruling; judges routinely take a settlement under advisement and issue a written order days or weeks after the hearing, sometimes longer.

The claim deadline, July 2, 2026, has already passed, so the settlement is not accepting new claims regardless of what happens with final approval next. If you filed by that date, your claim is in the queue. If you did not, there is currently no way to submit one.

No payment date has been set, and none can be set until a final approval order exists. This page will not guess one.

It is also worth separating two other dates that are easy to confuse. The deadline to opt out of the settlement, and the deadline to object to it, both fell on June 2, 2026, and both have also passed. Opting out means leaving the class to keep your own right to sue separately, but it also means giving up any payment from this fund. Objecting means staying in the class while telling the court the deal is unfair. Those were choices for before the final approval hearing; neither one is still available now, and neither is the same thing as filing a claim.

The Fund Is Two Separate Pools, Not One Number

You may see this settlement described elsewhere as a flat $24.45 million fund. That is not quite right, and the difference matters for what you can realistically expect.

There are two separate pools. The first is an $8.2 million cash fund. It pays the flat $25 no-documentation payment, documented ordinary and extraordinary loss claims, and the additional $100 available to California residents.

The second is a Crypto Pool, capped at $16.25 million. Unlike the cash fund, this is not a pot of money sitting ready to be divided; it is a ceiling. It pays only cryptocurrency-loss claims that a court-appointed Special Master, Bruce A. Friedman, Esq., individually reviews and validates, then pays pro rata if validated claims add up to more than the cap allows. The $24.45 million total is only reached if every dollar of both pools is actually paid out, which is not guaranteed for either one.

How Much People Realistically Get

Start with the tier most people will actually use. If you have, or had at the time of the 2022 incident, an active LastPass Consumer Premium, Family, or Business account with vault content, you may be eligible for a flat $25 statutory payment with no documentation required. California residents may additionally claim $100 in CCPA statutory damages.

Instead of the flat payment, you can submit a documented-loss claim: up to $300 for ordinary losses, such as time spent or minor unreimbursed costs, or up to $10,000 for extraordinary losses. Both come from the general cash fund, and both require records tying the loss to this breach. Like every figure paid from the cash fund, actual amounts are subject to pro-rata adjustment; the settlement pays estimates, not guarantees.

Then there is the figure that gets the most attention: up to $900,000 per claimant for documented cryptocurrency losses. Treat that number carefully. It is a per-claimant ceiling, not an expected payment and not what a typical crypto-loss claimant will see. Every crypto claim is individually adjudicated by the Special Master, reduced pro rata if validated claims exceed the $16.25 million pool cap, and reduced further by Special Master and expert fees before anyone is paid. Realistically, most people should not expect anywhere near $900,000. That figure exists to cap the largest documented individual losses, not to describe a normal outcome.

What Proof You Need, by Tier

The $25 statutory payment needs no proof of loss, only that you had a qualifying active account with vault content at the time of the incident. The $100 CCPA payment needs only California residency at the relevant time.

Ordinary and extraordinary loss claims need documentation: receipts, statements, or other records showing an actual, unreimbursed loss connected to the 2022 incident, up to the applicable cap. Cryptocurrency-loss claims need the most: records establishing that the loss occurred, its dollar value, and a credible connection to the breach, since the Special Master reviews each one individually rather than accepting a self-certified number.

How Filing Worked

Filing was free and only ever available through the official settlement site. The claim deadline was July 2, 2026, and that window is now closed. If you filed on time, there is nothing further to submit while the case awaits final approval. If you missed it, there is currently no path to file late through this settlement.

If you did file, what happens next is mostly out of your hands. Once (and if) the court enters a final approval order, the settlement moves into claims administration: validating submitted claims, calculating pro-rata shares from the cash fund, and, for anyone who filed a crypto-loss claim, waiting on the Special Master's individual review. None of that has started in a way that produces a payment date yet, and the official settlement site remains the only place to check your own claim status rather than a search result or an unsolicited email.

If You're Worried About What Was in Your Vault

Whatever happens with final approval, the exposure from 2022 does not reset itself. If your LastPass vault held saved passwords, treat every one of them as compromised: change them, starting with financial and email accounts, and avoid reusing a password across sites.

If your master password predates the 2022 incident, change it now, and turn on multi-factor authentication if you have not already. The Cybersecurity and Infrastructure Security Agency lists enabling multi-factor authentication as one of the most effective single steps anyone can take to keep an account safe even after a password is exposed.

If you stored cryptocurrency wallet keys or seed phrases in a LastPass vault and have not already moved those funds to a new wallet with new keys, do that regardless of where this settlement ends up. A settlement payment, even at the maximum, will not replace stolen cryptocurrency dollar for dollar.

More broadly, a free credit freeze at all three major bureaus, Equifax, Experian, and TransUnion, blocks new credit from being opened in your name and costs nothing. Our guide to freezing your credit after a data breach walks through all three, step by step. If you already suspect identity theft, IdentityTheft.gov, the FTC's free recovery site, builds a personalized recovery plan.

More Open and Closed Settlements

If LastPass is not the only breach notice in your inbox, our data breach settlement tracker lists the settlements we have verified, open and closed.