Dashlane Brute-Force Attack Downloads <20 Encrypted Vaults: What Was Reportedly Exposed & What To Do

On June 2, 2026, Dashlane reported that a brute-force campaign beginning May 31 had allowed attackers to download encrypted password vaults belonging to fewer than twenty personal-plan users. The company stated that the vaults remained protected by master passwords, that the affected accounts were suspended and later restored, and that the users involved were notified directly. The incident is notable because it involved a password-management service whose core function is to store credentials in encrypted form. Even a small number of compromised vaults can create downstream risks if the corresponding master passwords are weak or reused elsewhere.

Breaking down the breach

Dashlane disclosed that the activity consisted of repeated login attempts aimed at bypassing two-factor authentication and registering new devices on targeted accounts. The campaign resulted in the download of encrypted vaults for fewer than twenty users. No other data types were reported as accessed. The company has not released further details on the scale of the attempts, the infrastructure used, or the duration beyond the May 31 start date.

How a breach like this happens

Brute-force campaigns against online accounts typically involve automated tools that test large numbers of credential combinations or exploit weaknesses in authentication flows. When two-factor authentication is present, attackers may attempt to intercept or bypass it through device-registration prompts or session manipulation. If an attempt succeeds in initiating a session, any data that can be downloaded before the account is locked becomes accessible to the attacker. In services that store user data in encrypted containers, the encryption itself remains the primary control even after a download occurs.

Dashlane and its sector

Dashlane operates as a password manager, providing encrypted storage for user credentials and related information. Organizations in this sector hold data that users rely on to secure access to email, banking, workplace systems, and other services. A breach at such a provider is consequential because the stored material, if decrypted, can be used to compromise multiple other accounts belonging to the same individuals.

What data was at risk

The only data type named in the disclosure is encrypted password vaults belonging to fewer than twenty personal-plan accounts. Dashlane has not published additional details on the contents of those vaults or on any other records that may have been present. Organizations of this type commonly store usernames, passwords, notes, and payment information inside the encrypted containers, but the exact composition of the downloaded files remains unconfirmed beyond the description provided by the company.

What's at stake

For the small number of affected users, the primary risk is that an attacker could attempt to decrypt the downloaded vaults offline if the master password is weak or has been used on other sites. For the wider user base, the incident underscores that even services designed around encryption can be targeted at the authentication layer. Dashlane has stated that affected accounts were suspended and restored, which limits further access but does not eliminate the need for individual users to review their account activity.

Were you affected?

Users who received a notification from Dashlane should follow the instructions provided in that message. Anyone can take the following steps regardless of notification status:

• Review recent login activity in the Dashlane account settings.
• Change the master password if it is weak, reused, or has not been updated recently.
• Confirm that two-factor authentication remains enabled and review registered devices.
• Monitor other important accounts for unusual login attempts.

Readers can run a free exposure scan of their email address to check whether their information has appeared in known breach data sets.

AICompiled with AI assistance from public sources and published under our editorial standards.