“The threat actor was also able to copy a backup of customer vault data from the encrypted storage container which is stored in a proprietary binary format that contains both unencrypted data, such as website URLs, as well as fully-encrypted sensitive fields such as website usernames and passwords, secure notes, and form-filled data.”
The attackers have the vaults. Your passwords are encrypted. The list of every site you use is not. LastPass dropped this right before Christmas and says brute forcing would be “extremely difficult” if you followed its best practices. Change every password you care about.