Dashlane issues opaque advisory warning 20 encrypted vaults were stolen

Dashlane has issued a troubling alert regarding a recent security incident, revealing that 20 encrypted user vaults have been compromised. The company reported that an external party initiated a brute-force attack on certain user accounts beginning Sunday, May 31, 2026. This attack aimed to bypass two-factor authentication (2FA) protections, allowing the intruder to register new devices on existing accounts. Users have taken to social media to express confusion over the mechanics of the attack. Typically, 2FA relies on one-time passwords generated by an app or received via text or email, which are usually six digits long and refresh approximately every 45 seconds. The brute-force method involves systematically trying every possible combination until the correct one is found. In this case, there could be up to 1 million possible codes, making the successful breach reliant on entering a significant number of them within a limited timeframe. While it's theoretically feasible for an attacker to flood Dashlane's servers with numerous attempts in a short span, this level of resource allocation is not typical in most brute-force scenarios. Dashlane has not explicitly confirmed whether it implemented rate limiting to restrict the number of submission attempts per user. However, the advisory indicates that due to the volume of attack attempts, the company’s security measures automatically locked affected accounts. Even without rate limiting, it's difficult to picture how Dashlane servers could handle over 150,000 2FA submissions in less than a minute without experiencing serious strain.