Dashlane’s June 2026 breach is a reminder that even password managers can become targets when attackers focus on account access rather than the encrypted vault itself. In this case, hackers used brute-force attacks against Dashlane’s two-factor authentication flow, gained access to a small number of customer accounts, and downloaded encrypted password vaults.
According to Dashlane’s disclosure, the attackers targeted the device-registration process, which lets a new phone or computer be added to an account after verification. Dashlane said the campaign affected about 20 customer accounts and resulted in at least a dozen encrypted vaults being copied, while the company’s own infrastructure was not compromised.
The good news is that the stolen vaults are still encrypted and cannot be opened without each user’s master password. Dashlane’s zero-knowledge design means it does not store master passwords in plaintext, so the immediate risk depends heavily on how strong and unique the user’s master password is.
That said, the incident still matters because an encrypted vault can be dangerous if the master password is weak, reused, or already exposed elsewhere. Security researchers also noted the broader lesson: once attackers have a copy of the vault, they can attempt offline cracking without triggering more defenses on the service side.
That said, the incident still matters because an encrypted vault can be dangerous if the master password is weak, reused, or already exposed elsewhere. Security researchers also noted the broader lesson: once attackers have a copy of the vault, they can attempt offline cracking without triggering more defenses on the service side.
For users, the safest response is to change the master password to a long, unique passphrase, review recently registered devices, and reset any sensitive accounts stored in the vault, starting with email, banking, and identity services. It is also wise to use phishing-resistant 2FA such as a hardware security key where possible, and watch for suspicious password-reset emails for the next few weeks.
This article has been indexed from CySecurity News – Latest Information Security and Hacking Incidents
Read the original article: