LastPass UK Limited

What the regulator decided

In August 2022 an attacker compromised the corporate laptop of an EU-based LastPass employee and then a US-based employee's personal laptop used for work, capturing a master credential and accessing the LastPass backup database to take customer names, email addresses, phone numbers and stored website URLs of up to 1.6 million UK customers; LastPass had not implemented appropriate controls around BYOD device usage, breaching Article 5(1)(f) and Article 32(1) UK GDPR.

ConsentMark interpretation

Operator-readable note on how this case shapes the ConsentMark scanner narrative. Not a legal opinion; cites the primary source.

EUR amount approximate. The ICO highlighted BYOD-on-personal-devices as the central control failure - LastPass's zero-knowledge vault encryption prevented full credential extraction, but metadata loss alone was sufficient for an Article 32 breach. Cite when a scanner finds analytics or operations administered from personal devices outside a managed endpoint estate.