Summary
Password manager Dashlane disclosed on June 5, 2026, that attackers successfully downloaded encrypted vaults from a small number of user accounts following a brute-force attack that began on May 31. The attackers targeted the two-factor authentication flow used during new device registration, generating valid tokens for fewer than 20 personal plan accounts before Dashlane’s automated defenses locked the compromised accounts.
While Dashlane emphasizes that the vault data cannot be decrypted without each user’s Master Password — protected by Argon2 key derivation with AES-256-CBC encryption — the incident draws uncomfortable parallels to the 2022 LastPass breach where stolen encrypted vaults were later targeted for offline cracking. Dashlane maintains its zero-knowledge architecture was not compromised and has notified all affected users directly.
In response, Dashlane has added additional network-level protections and extra verification steps to the device registration flow. Users are advised to review registered devices, remove any unrecognized entries, and ensure strong, unique master passwords are in place.
Sources
- SecurityWeek — Dashlane Brute-Force Attack Leads to Limited Encrypted Vault Downloads
- The Hacker News — Dashlane Discloses Brute-Force Attack
- Dashlane Official Security Advisory
Commentary
This is a bad look for the password manager industry. Even though only ~20 vaults were exfiltrated and they remain encrypted, the optics of “hackers stole password vaults” will dominate headlines — and rightfully spook users who remember what happened to LastPass. The critical difference is scale: LastPass lost millions of vaults while Dashlane contained the blast radius to under 20. Still, any password manager that allows vault downloads through a 2FA bypass has a design problem that needs more than a patch.
If you use Dashlane, this is your reminder to ensure your Master Password is long, unique, and not derived from anything guessable. If you’re using any password manager, take this as a prompt to audit your registered devices and enable hardware security keys where supported. The zero-knowledge model is only as strong as the master password protecting it.