* Connecting from my own IP with wrong password: It tells me to "Check my master password and try again."
* Connecting from another IP with wrong password: It tells me to "Check your inbox for an email from LastPass: <myemail**@gmail.com>" and also to check my login info.
It's a bit odd that it tells me to check my email even though the master password I provided was incorrect.
But when you did attempt to login with a wrong password, you never received a "Someone just used your master password to try to log in to your account from a device or location we didn't recognize" email, correct?
As far as I can tell, the "Someone just used your master password to try to log in to your account from a device or location we didn't recognize" email we all received was only sent when a correct password was used. Incorrect passwords did not trigger that email.
But yes, it would be great to learn that those emails were sent incorrectly i.e. it was a false positive (i.e. someone tried to login with a wrong password, but the email above was sent anyway). It's still not great that the wrong kind of email was sent, but that would be a low level bug.
https://www.techradar.com/au/news/lastpass-accidentally-scar...
I don't know how much to read into their use of "some" and "likely" i.e. "some of these security alerts, which were sent to a limited subset of LastPass users, were likely triggered in error"
I would want to know whether they can demonstrate that wrong passwords were used in this attack. And have an explanation for those users who received the email a 2nd time after changing their passwords.