Dashlane Brute-Force Attack Exposes Encrypted Password Vaults via 2FA Bypass

Password manager Dashlane disclosed a significant security incident on June 1, 2026. Starting May 31, an external party launched a brute-force attack against Dashlane's two-factor authentication (2FA) system. The attackers systematically guessed 2FA codes until they broke through, gaining access to approximately 20 customer accounts. From those accounts, they downloaded encrypted password vaults — fewer than 20 in total.

Dashlane's security advisory confirms that the vaults are encrypted with the user's master password using zero-knowledge architecture. The company stated that direct access to vault contents remains statistically unlikely without the master password. However, users with weak or easily guessed master passwords could face elevated risk.

The attack triggered Dashlane's automated defenses, which temporarily locked affected accounts and suspended suspicious sessions. The company is requiring affected users to reset their master passwords and re-secure their accounts.

This incident highlights an uncomfortable reality for password manager users: even with zero-knowledge encryption and 2FA, the authentication layer itself can become the attack surface. Brute-forcing 2FA codes is technically straightforward when rate limiting is insufficient, and the prize — a complete vault of credentials — makes the effort worthwhile for attackers. The incident joins a growing list of security events targeting credential management infrastructure in 2026, including the ongoing cPanel exploitation affecting over 40,000 servers.