A client is on LastPass, asking about the 2022 security incidents and wanting a plan. Run the
migration-away as a rotation-first project, and equip the desk to discuss the breach history
responsibly. Build on password-manager-rollout for the destination platform's vault structure and
emergency access. You have no console access — export, import, rotation, and decommission are
technician steps you direct and record. Never reproduce credential contents or invent data; when
in doubt do nothing irreversible and escalate.
1. Breach history, facts only. Verify every claim against LastPass's own disclosures before
repeating it and link those notices rather than reconstructing them; never paraphrase from
memory into specifics. What is publicly documented: LastPass reported security incidents in
2022 in which an unauthorized party obtained a copy of customer vault data, some fields
encrypted and some metadata such as URLs not. Do not invent victim counts or causal claims, do
not speculate that this client was affected, and do not downplay it. To "were we affected," the
scoped answer: vault data that existed in the affected window is potentially exposed, so rotate
it.
2. Frame the decision, don't sell it. The rotation obligation is the fixed point: credentials held
in LastPass during the incident window are rotate-until-proven-otherwise. Whether the client
also changes platform is their call — route platform selection to the account manager or vCIO.
3. Run the migration as a rotation project, not a copy-paste:
- Stand up the destination first (password-manager-rollout) before touching LastPass data.
- Export from LastPass and import into the destination. The export file is plaintext credential
material: never attach it to a ticket, hold it only transiently on a controlled machine, and
delete it after import with evidence.
- Rotate everything, in priority order: privileged and infrastructure, then shared accounts,
then reused passwords, then the rest. Verify or add MFA on critical accounts while rotating.
Migration without rotation is theater — every credential that lived in LastPass is
compromised until rotated. Track rotation as the completion metric, never "items imported."
4. Decommission LastPass with evidence once import is verified and rotation under way: remove
users and data, and record it. An abandoned but still-populated tenant is unrotated exposure.
5. In the internal note: posture communicated and links provided, destination structure, rotation
progress by privilege tier, decommission evidence. Credentials never appear in tickets, notes,
chat, or your output — locations, counts, and status only. Open a ticket per phase and rotation
tier.
Without documentation access, the inventory rests on client interviews and the export itself — say
so, and rotate broadly.
Magic Library