Berman Tabacco serves as co-lead counsel in In re LastPass Data Security Incident Litigation, No. 1:22-cv12047-PBS (D. Mass.), a consolidated federal class action arising from an alleged 2022 cybersecurity incident involving LastPass US LP (“LastPass”), a widely used password‑management service, in which a threat actor obtained access to both encrypted customer vaults and unencrypted customer metadata stored in LastPass’s cloud‑based backup environment exposing data of more than 33 million users and 100,000 businesses worldwide.
In a July 30, 2024 Memorandum and Order, the court denied in part defendants’ motion to dismiss, holding that plaintiffs had plausibly alleged standing and legally cognizable injuries resulting from the breach, allowing several core claims against LastPass to proceed beyond the pleading stage. After extensive and highly technical discovery, the case settled providing for a settlement worth up to $24.45 million, including an $8.2 million non‑reversionary cash fund available to qualifying U.S. consumers and businesses whose LastPass accounts contained data and were allegedly compromised during the August–November 2022 incident, as well as a separate $16.25 million cryptocurrency reimbursement pool, distinct from the general settlement fund which can provide up to $900,000 in relief for claimants. This carve‑out reflects the magnitude and uniqueness of crypto‑related losses flowing from password‑manager breaches and represents a first-of-its-kind process for recovery of stolen cryptocurrency by class members.