Assuming that, at some point, LastPass would provide password databases to anyone who only knew an account's username and password regardless of which computer they connected from, then the answer is basically "yes, it's possible".

Under those conditions, if an attacker was able to crack a user's master password and log in to that user's LastPass account before LastPass changed their security, a user's password database could certainly have been compromised.

However, that window of time was (presumably) small. With proper security practices in place regarding the hashing & storage of master passwords, it would be generally unlikely that anyone with a strong master password would have had their account compromised within that window. Accounts with extremely weak and/or common master passwords may have had their hashes cracked, but anyone else would probably be "safe".

That said, it is even still very possible that some users may have their accounts broken into even with the new security measures. LastPass is falling back to e-mail verification for new systems that access an account. If a user's master password is cracked, and that same password is all that protects their e-mail account, then it would be fairly trivial for an attacker to work around the new security measure.

Assuming that, at some point after the breach, LastPass would have provided password databases to anyone who only knew an account's username and password, regardless of which computer they connected from, then the answer is basically "yes, it's possible".

Under those conditions, if an attacker was able to crack a user's master password and log in to that user's LastPass account before LastPass changed their security, a user's password database could certainly have been compromised.

However, that window of time was (presumably) small. With proper security practices in place regarding the hashing & storage of master passwords, it would be generally unlikely that anyone with a strong master password would have had their account compromised within that window. Accounts with extremely weak and/or common master passwords may have had their hashes cracked, but anyone else would probably be "safe".

That said, it is even still very possible that some users may have their accounts broken into even with the new security measures. LastPass is falling back to e-mail verification for new systems that access an account. If a user's master password is cracked, and that same password is all that protects their e-mail account, then it would be fairly trivial for an attacker to work around the new security measure.