Your Passwords Are Only As Safe As the Company Holding Them.
Cloud storage is convenient. Cloud password managers are convenient. Automatic backups to the cloud are convenient. Convenience, however, is not the same as secure — and the gap between those two things has cost millions of people dearly.
When you store your passwords, your documents, your photos, or your personal data in the cloud, you are not storing them somewhere abstract and intangible. You are storing them on a server owned and operated by a company — a company that has employees, that has competitors, that has security vulnerabilities, and that can be breached. The question is not whether that company will experience a security incident. The question is whether your data will be in the blast radius when it does.
The LastPass Breach — A Masterclass in What Can Go Wrong
LastPass is one of the most widely used cloud-based password managers in the world. Its entire value proposition is security — it exists to keep your passwords safe. In 2022 it was breached. Twice.
In the first incident, attackers accessed LastPass’s development environment and stole source code, technical documentation, and an encrypted copy of a key used to protect customer data backups. In the second incident, a senior engineer’s personal computer was compromised using a keystroke logger. The attacker used the credentials obtained to access an internal vault containing further encryption keys — which were then used to access and download a backup of customer password vault data.
That backup contained both unencrypted fields — including website URLs showing which services customers used — and encrypted fields containing usernames and passwords. The encrypted data cannot be immediately read, but it can be subjected to offline cracking attempts indefinitely, at whatever pace and with whatever hardware the attacker chooses to deploy against it.
In 2025, LastPass settled a class action lawsuit for $24.5 million. The UK Information Commissioner’s Office issued a financial penalty against the company for failures to implement appropriate security measures. More than one million UK customers alone were affected.
LastPass existed specifically to protect passwords. It was breached anyway. If the company whose entire business model is security cannot prevent a breach, no company can guarantee it.
The Scale of the Problem
LastPass is not an anomaly. It is an example.
Significant cloud breaches increased by 154 percent in a single year, with 61 percent of organizations reporting major incidents in 2024 compared to 24 percent the year before. In the first quarter of 2025 alone, organizations faced an average of 1,925 cyberattacks per week. The average time to detect a cloud breach is 277 days — meaning attackers have access to compromised data for the better part of a year before anyone realizes something is wrong.
In 2024, a breach at Snowflake — a cloud data platform used by hundreds of major companies — resulted in the theft of records from numerous high-profile organizations. In December 2024, PowerSchool, an educational technology provider, was breached through compromised credentials. Personal data of over 60 million students and staff across the United States and Canada was exposed.
These are not fringe cases. These are household names. The pattern is consistent and the trajectory is not improving.
The Specific Risk of Cloud Password Managers
Cloud password managers present a unique risk profile that is worth understanding clearly.
The appeal is obvious — one place to store all your passwords, accessible from any device, with automatic syncing. The risk is equally obvious once you think it through: you are storing every key to your digital life in a single location managed by a third party. If that third party is compromised, the attacker potentially has access to everything.
Recent independent research has raised further concerns about cloud-based password managers, identifying issues with legacy encryption methods that some providers still support for backward compatibility. These older encryption standards are significantly easier to crack with modern hardware. One provider began phasing out these legacy methods as recently as late 2025 — meaning they were present and exploitable for years before being addressed.
Even 1Password, which performed best in independent security testing, acknowledged what it called architectural limitations — an admission that cloud-based password managers always carry at least some inherent security risk by design.
The Case for Local Backup
The solution is not to abandon digital tools. It is to stop treating the cloud as the only copy of anything important.
Local backup means keeping a copy of your critical data on a physical device that you control — a device that is not connected to the internet, not managed by a third party, and not accessible to anyone who does not physically have it in their hands.
For password management specifically, this means either using a locally stored password manager — one that keeps its vault on your device rather than on a company’s server — or maintaining an encrypted local backup of your vault that you update regularly.
For documents, photos, financial records, and other important files, it means having at minimum one copy that lives on a physical drive you own, stored in a location you control. The 3-2-1 backup rule is the professional standard: three copies of your data, on two different types of media, with one stored off-site. Most people have zero.
What You Can Do
None of this requires technical expertise. It requires attention and a small investment of time.
Audit what you are storing in the cloud. Open your cloud storage, your password manager, and any other cloud services you use. Understand what data is there and what the consequences would be if it were exposed.
Consider a local password manager. Tools like KeePassXC store your password vault locally on your device, encrypted. There is no cloud sync, no third-party server, no company to be breached. The vault file is yours and goes nowhere unless you send it somewhere.
Back up your password vault locally. If you prefer to keep using a cloud password manager, export an encrypted backup of your vault regularly and store it on a local drive. Most password managers support this. Few users do it.
Back up your important files to a physical drive. An external hard drive or SSD costs very little and provides a local copy of your data that no remote attacker can access. Plug it in, copy your files, unplug it, put it somewhere safe. That is the entire process.
Use a strong, unique master password. If you use a cloud password manager, your master password is the last line of defense if your vault is stolen. Make it long — sixteen characters minimum — and do not use it anywhere else.
The cloud is someone else’s computer. Convenient, yes. But when that computer is breached — and breaches are not rare — your data goes with it. A local backup costs almost nothing. The absence of one can cost everything.
Cloud services are useful tools. They are not a substitute for ownership of your own data. The most important files in your life deserve to exist somewhere that does not depend on a company’s security team doing their job perfectly — because history has shown, repeatedly, that they do not.
