Attack Overview and Impact
Dashlane has alerted users to a security incident involving a coordinated brute-force attack against a small number of personal subscription accounts. The company reported that on May 31, 2026, an external attacker launched a high volume of automated login attempts targeting specific user accounts. The goal was to bypass two-factor authentication protections and register new devices on compromised accounts.
Dashlane’s internal security systems triggered temporary suspensions for the affected accounts due to the unusual activity. However, the attacker succeeded in a limited number of cases. The company confirmed that encrypted vaults belonging to fewer than 20 users were downloaded. Direct notifications have been sent to all impacted individuals.
Protection Measures and Guidance
The downloaded vault data remains protected by each user’s Master Password. Unless that password is weak or easily guessed, the encrypted contents cannot be accessed. Dashlane emphasized that its internal infrastructure was not compromised during this incident.
Users are encouraged to take several precautionary steps. These include reviewing the list of devices registered to their account and removing any unrecognized entries, enabling two-factor authentication if not already active, and ensuring their Master Password is long, unique, and difficult to guess. The company noted that the attacker specifically targeted the device registration API endpoint, sending automated requests in an attempt to add new devices to existing accounts.
Source: The Hacker News
