Were the actual passwords at LastPass breached?

No, the passwords are stored in LastPass's encrypted vaults and were not affected. The compromised data pertains only to customer support and associated information.

What should be done to counter the FortiBleed campaign?

Default passwords should be changed, multi-factor authentication enabled, and login logs and security configurations should be reviewed on FortiGate devices.

Major Breaches Shake Data Security: Klue and Fortinet in the Spotlight | Wabl

A series of cyberattacks have resulted in the theft of LastPass data through a breach of a partner, and a massive campaign targeting FortiGate devices raises concerns about network security.

Wabl