I'm pretty disappointed with how this has been handled. Mainly in two ways:

- The scale of the breach (leaking of PII and encrypted vaults, that URLs are not encrypted) has only come almost 4 months after the initial investigation. When was such a breach suspected in the first place? I would expect extremely timely reponses for this stuff.

- They suggest no recommended actions? Surely rotating credentials should be advised? Feels like they are putting business before security.

It's not just the leak that makes me lose complete faith in Lastpass. It's how they've handled the leak.