Encryption changes the result of a breach; it does not make a breach irrelevant. The 2022 LastPass incident is a useful case because copied vault backups contained both encrypted secrets and information that was not encrypted.
What the incident established
LastPass reported that an attacker copied a backup of customer vault data. Its incident notice distinguishes fully encrypted vault fields from unencrypted data such as website URLs and account information. That distinction is the story—not a reason to say that encryption failed or that it made the incident harmless.
Ciphertext is still worth protecting
For a Protected Inpages Memory, Rails stores ciphertext for the selected title, body, external-link values, and protected file bytes. A copied database or Active Storage volume therefore does not contain their ordinary readable text or media. The browser encryption architecture shows where that transformation happens.
Metadata needs its own review
An encrypted record can still have an identifier, timestamps, protection state, record relationships, attachment counts, file sizes, content types, and hashtags. These fields may support normal operation, but they can also reveal patterns. This is why a breach explanation should never turn “encrypted content” into “no useful information was exposed.”
Passwords affect offline guessing risk
Inpages derives a key-encryption key from the Vault Password with Argon2id, then uses that key to unlock the stored Encrypted Master Key. That raises the cost of guessing, but it cannot make a weak Vault Password strong. It also means the service cannot reset a lost secret and silently restore protected writing.
Recovery is a different question
A backup can restore encrypted records and still leave them unreadable if the owner lost every way to unlock the Master Key. Conversely, an exported Recovery Key cannot recreate a record deleted from every copy. The Recovery Key design keeps those responsibilities separate.
The Inpages boundary
The useful claim is narrow: a server-side data copy does not by itself reveal the protected plaintext or file bytes, because the usable Master Key is not stored in that copy. It is not a claim that metadata vanishes, that passwords do not matter, or that endpoint compromise is impossible. See also metadata as a privacy risk.