This article prompted me to question how safe last pass really is.

Beyond changing passwords and having 2fa set up, is there anything else we can do?

Maybe I’ll move some more important things away from last pass and only use it for less critical services and sites.