> The initial investigation found no evidence of threat actors accessing customer data or password vaults, meaning no action from end users was required.

I think the key word here is "initial" - they have no evidence thus far that user data was compromised, but that doesn't mean it wasn't, or even that evidence doesn't exist - right?

I get wanting to make a statement promptly and reassure customers but I'm not sure how valuable this is for users of LastPass. Should they just assume everything is fine until the company discovers it's not?