I thought about that also, and then one of the victims I talked to brought up a good point. An 8 character password with symbols and numbers doesn't sound like a great password today, but many of the accounts getting drained were tied to people who were very early LastPass users, and mostly longtime investors. Back then, affordable GPUs that can do 4 million hash cracking attempts per second weren't really a thing.
What I found was a lot of people made security assumptions and never revisited those assumptions. Or never fully did.
What I found was a lot of people made security assumptions and never revisited those assumptions. Or never fully did.