Dashlane breach allows vault downloads for <20 users

A password management service has disclosed that a recent security incident involved attackers successfully downloading encrypted vaults belonging to a small number of users. Dashlane confirmed that an external threat actor launched a brute-force attack against certain user accounts beginning on May 31, 2026, triggering the company's automated security systems.

The attack aimed to bypass two-factor authentication protections to register new devices on existing accounts. The high volume of login attempts led to temporary suspensions and authentication issues for a number of users, though the exact number targeted remains undisclosed. The company stated that its built-in security controls functioned as designed to block the automated attempts.

In an update, Dashlane revealed that the attackers were successful in a limited number of cases, enabling them to download copies of encrypted password vaults. The company said this impacted fewer than 20 users on its personal subscription plan and that those individuals have been directly notified. It emphasized that the vault data remains encrypted and inaccessible without the user's master password.

The incident caused confusion among...