Dashlane Says Brute-Force Run Pulled Encrypted Vaults From Under 20 Accounts

Dashlane disclosed that an external party ran a brute-force campaign against personal-plan accounts on May 31, 2026, and successfully downloaded the encrypted vaults of fewer than 20 users.

The stated goal was bypassing two-factor authentication on specific accounts. Not a credential-stuffing spray at the login page in the usual sense — a targeted push against the 2FA layer for users whose primary credentials the attacker presumably already held.

That distinction matters. It implies the master password (or a usable surrogate) was already in play before the 2FA attempt began. Where it came from, Dashlane hasn't said.

What the attacker walked away with: encrypted blobs. Dashlane's architecture is zero-knowledge, meaning vault contents are decrypted client-side using a key derived from the user's master password. The server never sees plaintext. The downloaded vaults are only as exposed as the master password protecting them is weak (or reused, or already in a breach corpus).

For the affected users, that's the actual risk profile. A strong, unique master password with sufficient entropy makes offline brute-force against the vault impractical on current hardware. A weak or reused one makes it a matter of GPU-hours.

Dashlane has not, at time of writing, published a CVE, a CVSS score, or a technical post-mortem detailing the rate limits, lockout thresholds, or 2FA implementation that allowed the brute-force to succeed against any account. Those are the questions defenders should be asking. Why did the second factor fall? Was it TOTP, SMS, or push? Were rate-limits absent or merely insufficient?

The vendor's own notice is the primary source here, and it's thin on the implementation detail that would let other password-manager operators learn from the incident.

Operational guidance for affected (and unaffected) Dashlane users:

• Rotate the master password immediately if you have any reason to suspect it's weak, reused, or has appeared in a public breach.
• Rotate every credential stored in the vault, prioritizing email, financial, and SSO accounts. Treat the encrypted vault as compromised until proven otherwise.
• Re-enroll 2FA factors and, where supported, move from TOTP/SMS to a hardware security key or passkey.
• Audit account activity logs in Dashlane for unfamiliar device sessions.

The broader point isn't novel but bears repeating: a password manager's server-side breach is survivable when the cryptographic design holds and users picked decent master passwords. Both conditions have to be true. The 2018 and 2022 incidents at competitors made the same lesson expensive for a lot of people.

Dashlane says it's notified the affected accounts directly. The company has not attributed the activity to a known threat actor and has not, so far, indicated whether law enforcement is involved. Threat Vectr has reached out for additional technical detail and will update if the vendor provides it.