However - with the advent of DevOps, the company's developers and DevOps engineers are holding 'the keys to the kingdom' - namely credentials to the company's cloud environment, IaC provisioning and more. Up until a few years ago, threat actor campaigns that targeted developers were few and far between (most threat actors were targeting IT administrators or specific servers). If the attackers manage to brute force a user's master password (which is definitely feasible on some weaker passwords), all of the user's website usernames and passwords will be available to the attackers. Other than that, attackers can now perform offline brute-forcing on the user's master password. This is a very severe leak, since it means that immediately attackers have access to the website URLs, which can be used in some cases for performing privileged operations in the name of the victim or for phishing and blackmail purposes.

Encrypted Website usernames and passwords - The actual usernames and passwords saved by LastPass, encrypted with the user's master password (which is not stored on LastPass' cloud servers).

These URLs may contain extremely sensitive information, such as parameters that are used for logging in, resetting passwords etc.

Unencryptedwebsite URLs - URLs saved by the LastPass browser extension, which provide a partial history of the website that the LastPass user has visited.

Lastpass security breach