A password management service has disclosed that a recent security incident involved attackers successfully downloading encrypted vaults belonging to a small number of users.