Not passwords, but the hackers have some unencrypted data because LastPass did not encrypt all vault data client-side:

"The threat actor was also able to copy a backup of customer vault data from the encrypted storage container which is stored in a proprietary binary format that contains both unencrypted data, such as website URLs" - https://blog.lastpass.com/2022/12/notice-of-recent-security-...

The "such as..." without enumerating everything is very ominous as well.

I believe they are only the encrypted vaults, but with the cost of compute plummeting and the inclusion of unencrypted data alongside the encrypted data I think you have reason to worry if you believe there are people who would perform a dedicated attack on you, or you are in a class likely to be identified as high value.

Oh, absolutely, you need to test that information as exposed and react accordingly.

Fortunately for me, I don't use LastPass.

> the cost of compute plummeting

You should do some actual math to roughly estimate what it would take to crack a good password. Use a strong password, use a resource-intensive key derivation function, and you should feel extremely comfortable that your encrypted data will not be cracked within your lifetime.

No, but apparently the urls were not encrypted, so that could be quite a gold mine for blackmail.