NewsPublished 2 Jun 2026

Dashlane Brute-Force Attack Leads to Limited Encrypted Vault Downloads

Source SecurityWeek

Description

Dashlane experienced a brute-force attack targeting its two-factor authentication (2FA) system, where attackers attempted to rapidly guess numeric 2FA codes to register their own devices on user accounts. This allowed attackers to download encrypted vaults from fewer than 20 personal plan users. Dashlane's security systems detected the attack quickly and automatically locked affected accounts to limit impact. The encrypted vaults remain protected by the users' master passwords, which were not compromised. There is no evidence of any impact on Dashlane's internal systems. Affected users have been notified and accounts restored.

Impact

Attackers were able to download encrypted vaults from fewer than 20 personal plan users by bypassing 2FA device registration via brute force. However, vault contents remain protected by strong encryption requiring the master password, which was not compromised. There is no evidence of internal system compromise or broader impact. The incident was contained by automatic account locking.

Defensive guidance

Dashlane's automatic account locking effectively limited the attack's impact. Affected accounts have been restored and users notified. Vault encryption and master password protection remain the primary defense against unauthorized access. Users should remain vigilant against phishing attempts, as the master password is the only way attackers could gain vault access. Patch status is not applicable as this is an attack scenario rather than a software vulnerability. No additional user action is required beyond standard security practices.

Summary

The threat involved a brute-force attack against Dashlane's 2FA mechanism, where attackers used automated software to rapidly try all numeric combinations to register devices on targeted accounts. Successful device registration enables downloading the user's encrypted vault from Dashlane servers. Despite the attack, Dashlane's vault encryption and master password protection prevented unauthorized access to vault contents. The attack was detected early, triggering automatic account locks to limit compromise. Fewer than 20 encrypted vaults were downloaded. No internal system compromise was detected.

References

securityweek.com/dashlane-brute-force-attack-leads-to-limited-encrypted-vault-downloads/ (opens in a new tab)

Community reviews

Loading reviews…

Description

AI analysisMachine-generated, updated 2 Jun 2026, 08:18 UTC

References

Community reviews

Related threats