LastPass Settlement 2026: Are You Owed Up to $10,000? Here’s How to Claim Your Money Before the Deadline

Watching a business you trust acknowledge that it failed you—quietly and through legal documents—leads to a certain kind of tiredness. That’s essentially what’s happening with LastPass, the password manager that marketed itself for years as the secure location to store your most private data. The company has agreed to a class action settlement of up to $24.45 million in response to its 2022 data breach, and notifications are currently reaching millions of American inboxes.

The actual breach, which occurred in two phases during the summer and fall of 2022, was more serious than LastPass first disclosed. Hackers stole encrypted copies of customer vault data, which are the real digital containers that contain users’ login credentials, secure notes, and saved passwords. Because the data was encrypted, it was the type of theft that doesn’t immediately register as catastrophic. However, the stolen vaults became a slow-burning liability for users with weak or reused passwords because encryption is only effective if the master password is strong. Significant cryptocurrency wallet thefts were linked to the LastPass breach, according to several reports. Attackers reportedly attempted to crack stolen vault data offline until they encountered an obstacle.

That arc of harm is addressed in the settlement. A flat $25 statutory payment to eligible US users—basically, everyone who had a LastPass account prior to November 2022, regardless of whether it was free, premium, or family tier—is allotted approximately $8.2 million of the total fund. To be honest, it’s a small acknowledgement. The anxiety of knowing that your credentials were in the hands of someone else is far greater than twenty-five dollars. However, it’s something. Under the state’s Consumer Privacy Act, Californians receive an extra $100. Over the past few years, this has become somewhat of a recurring financial tool in tech accountability cases.

A $16.25 million fund, which makes up the larger portion of the settlement, is set aside for cryptocurrency losses that can be linked to the hack. Individual cryptocurrency claimants may request reimbursement of up to $900,000, but a Special Master—an impartial third party whose decisions are final and enforceable—will make those decisions. Additionally, users who have documented monetary damages up to $10,000 can fall under the “extraordinary loss” category. Additionally, premium, family, and business account holders who had content stored in their vault at the time of the incident are still eligible for the $25 flat payment if they just want to acknowledge the harm without the paperwork.

A unique ID and PIN are needed to submit a claim, and they were sent by email from the domain LastPassSettlement@e.epiqnotice.com, which is run by Epiq Systems, the court-appointed settlement management company. It may not seem important, but that detail is crucial. Almost immediately after the notification emails were sent out in late March 2026, Reddit threads were flooded with people inquiring as to whether the email was a phishing attempt. It makes sense as a reflex. They had already been let down by a password manager once. It was inevitable that receiving an unexpected email requesting account engagement, along with a PIN and a link to an unknown website, would raise red flags. The emails turned out to be authentic. Epiq’s involvement was verified by court documents, and domain registration records directly connect Epiq Systems to LastPassSettlement.com.

LastPass, on the other hand, released a carefully worded statement in which it agreed to settle in order to avoid “the ongoing distraction and uncertainty of protracted litigation,” while maintaining that it denies the alleged claims. That’s a fairly standard line in corporate settlements, and aside from the fact that the company’s own language reveals something about its stance, there’s no particular reason to read too much into it. Not regret, precisely. Not a real accounting. It was more akin to a controlled way out of a costly and inconvenient situation. It is likely accurate to say that the company has made significant investments in its security infrastructure over the last four years. It’s another matter entirely whether that matters to users who watched their cryptocurrency balances after spending weeks changing their passwords.

A claim must be submitted by July 2, 2026. On July 14, the court will hold a final approval hearing. Users must submit their request by June 2 if they would like to completely opt out, maintaining their right to pursue individual litigation. Practically speaking, it’s important to note that the total number of claims submitted will determine the final payout amounts. Since the $25 payment comes from that $8.2 million fund, individual amounts may be lowered proportionately if an exceptionally high number of eligible users submit claims.

Beyond the details of who gets what, there is something worthwhile about all of this. LastPass held a unique position of trust. In addition to passwords, people kept emergency access codes, secure notes, and financial credentials—the real skeleton keys to their digital lives. The damage caused by the compromise of that repository went beyond technical issues. It was intimate in the sense that any breach of a trusted space is intimate. That won’t be entirely fixed by the settlement. $25,000 or even $10,000 cannot. However, for millions of impacted users, submitting a claim is at least a means of recording what transpired—a tiny, official admission that the breach was real, the losses were real, and someone is being held accountable.
Check your inbox if you used LastPass prior to November 2022. The email is authentic. The settlement is genuine. In contrast to the security pledges of 2022, the deadline is strict.