Yes and agree, pure speculation / inferring guesses. Based on the assumption the attacker would choose the easiest path. Although I did thought of Keepass leak, but most of the other incidents doesn't use KeePass though.

I just wish HN has a show newest comment first, it is bit hard to follow at the moment.

>LastPass seems a bit like a mess so I would not be surprised if they are to blame though.

Reading that. There is another possibility... no one was hacked..... it was just attacker trying to log in using the wrong password and the email Lasspass generated completely messed up.