[burnte]

"One of the most frustrating things about the LastPass leak is that they still haven't provided all the information needed to determine whether a customer is at risk."

Yes they have. They had a breach, and lied about it. You can't trust anything about them now. Assume a total breach and move on.

[phpisthebest]

The biggest problem here is for former customers.

What if you closed your account 5 years ago, did they still have backups?

[sedatk]

"Assume total breach" implies to update everything you had with them regardless of the timeframe.

[phpisthebest]

I assume for many people that is easier said than done

[sedatk]

It is, hence the gravity of the situation.