Passwords were NOT compromised.
It is hackers using existing compromised email/password combinations on brute force attempts at Lastpass.
That is why your Lastpass password should be a password that you have not nor will ever use on any other site.
It is hackers using existing compromised email/password combinations on brute force attempts at Lastpass.
That is why your Lastpass password should be a password that you have not nor will ever use on any other site.
However, at the moment I'm not satisfied that a compromise has been demonstrated, either. As near as I can tell, nobody has reported a compromise, just suspicious emails. That's not enough evidence to prove a compromise.
LastPass' response, so far, adequately covers what we've actually seen.
That may be correct, because several persons have reported reproducing that issue before the LastPass fix - they have written that they logged on with incorrect password while using an IP from another country and still got the email that their master password was used.