LastPass says states an “unauthorized party” got into the system through a compromised developer account and took some source code and proprietary LastPass technical information. “Our product and services are operating normally,” Toubba concluded.

While LastPass says there is no evidence that customer data or encrypted password vaults were compromised, the threat actors did steal portions of their source code and “proprietary LastPass technical information,” which could lead to compromises.

Time to change the master password anyway...?