# Dashlane Brute-Force Campaign Compromises Fewer Than 20 User Vaults in 2FA Bypass Attack


Password manager Dashlane has disclosed a targeted brute-force attack that exploited the company's two-factor authentication (2FA) system to register unauthorized devices on user accounts, resulting in the compromise of encrypted credential vaults from fewer than 20 personal plan users. The incident, which began on May 31, 2026, highlights both the effectiveness of automated attack tools against time-limited security codes and the critical importance of layered encryption in protecting sensitive credential storage.


## The Threat


Between May 31 and early June 2026, attackers launched a coordinated brute-force campaign against Dashlane's authentication infrastructure. Rather than targeting passwords directly, the threat actors focused on circumventing the company's two-factor authentication mechanism—a strategy that reveals an important shift in how sophisticated attackers are approaching credential-based services.


The attack methodology was straightforward but resource-intensive: attackers used automated software to rapidly submit every possible numeric combination to Dashlane's 2FA verification system. The goal was to guess the exact security code sequence before the time-limited verification window expired. Unlike password attacks that can occur across weeks or months, 2FA codes typically expire within 30 seconds to five minutes, making this approach dependent on high-speed submission rates and parallel attempts across many accounts simultaneously.


According to Dashlane, successful 2FA bypass attempts allowed attackers to register their own devices on compromised accounts. Device registration is a critical step in the Dashlane authentication workflow—it grants an authenticated device the ability to download the user's encrypted vault from Dashlane's servers. By obtaining this access, attackers could retrieve offline copies of their targets' encrypted password vaults for potential offline brute-force analysis.


## Background and Context


The Password Manager Landscape


Dashlane operates in a competitive market for enterprise and personal password management solutions, where security is the primary differentiator. The company serves millions of users across personal and business segments, storing encrypted copies of credentials, payment information, and identity documents. Any compromise—real or perceived—carries significant reputational risk.


The specific mechanics of this attack underscore why 2FA, while essential, is not an absolute security barrier. Two-factor authentication significantly raises the cost of account compromise by requiring attackers to possess or generate a second authentication factor. However, implementations vary widely:


  • Time-based one-time passwords (TOTP): Generated by authenticator apps, these require physical access to the user's authentication device
  • SMS-based codes: Vulnerable to SIM swapping and interception but still effective against most automated attacks
  • Numeric sequences: As Dashlane's implementation appears to be, these face entropy limitations

    • Dashlane's 2FA system, which generates short numeric codes, represents a lower-entropy option compared to authenticator-based TOTP implementations. A six-digit numeric code has only one million possible combinations, making brute-force feasible if an attacker can submit attempts rapidly before code expiration.


    ## Technical Details


    How the Attack Worked


    The attack chain consisted of several technical stages:


    1. Target identification: Attackers obtained a list of Dashlane email addresses (likely from prior data breaches or public sources)

    2. 2FA enumeration: Automated software initiated login attempts for target accounts, triggering 2FA code generation

    3. Rapid brute-forcing: Custom software submitted numeric code combinations at machine speed, attempting to match valid codes before expiration

    4. Device registration: Successful 2FA bypass allowed registration of a new trusted device

    5. Vault exfiltration: The authenticated device downloaded encrypted vault data from Dashlane's servers


    Why This Attack Succeeded (And Why It Was Limited)


    Several factors constrained the scope of this attack:


  • Detection and response: Dashlane's security systems automatically detected abnormal authentication patterns and locked affected accounts. The company stated that accounts were secured "to limit impact" within what appears to be hours of the attack's initiation
  • Encryption defense: Even where attackers succeeded in downloading encrypted vaults, the data itself remains protected by Dashlane's vault encryption, which uses the user's master password as the encryption key
  • Attack volume: Brute-forcing 2FA codes at scale requires significant computational resources and network bandwidth. The attack was ultimately limited to fewer than 20 compromised vaults—suggesting either resource constraints or successful earlier detection

    • The Role of Master Password Encryption


    Dashlane emphasized that "vault data cannot be accessed without the Master Password, and our vault encryption ensures that any attempts to gain access to the vault are statistically unlikely to succeed, even over a long period of time." This is a critical security control: even with an encrypted vault file in hand, attackers cannot extract usable credentials without either:


  • Obtaining the user's master password (typically only through phishing)
  • Breaking the encryption through cryptographic attacks (computationally infeasible with modern encryption)
  • Finding implementation flaws in the encryption system

    • This architecture represents a sound security model: the authentication layer (compromised) is separate from the encryption layer (uncompromised).


    ## Implications


    For Dashlane Users


    Affected users have been notified by Dashlane. The practical risk depends on individual circumstances:


  • High risk: Users who reuse their Dashlane master password elsewhere, or who have had that password exposed in prior breaches
  • Moderate risk: Users who enable additional authentication on critical services (email, banking) beyond Dashlane-stored credentials
  • Lower risk: Users with unique, strong master passwords and who maintain separate authentication factors for critical accounts

    • For the Broader Industry


    This incident provides several lessons:


    | Risk Factor | Implication |

    |---|---|

    | 2FA code entropy | Six-digit numeric codes are increasingly vulnerable to rapid brute-force attacks; authenticator-based TOTP is preferable |

    | Device registration workflows | Device registration should require additional authentication barriers beyond 2FA alone |

    | Rate limiting | Dashlane's rate limiting ultimately contained the attack, but faster detection may have prevented even these 20 compromises |

    | Encryption architecture | The separation of authentication and encryption defenses proved effective; master password encryption saved this from becoming a full credential leak |


    Comparative Context


    This attack is more sophisticated than opportunistic brute-forcing but less sophisticated than insider attacks or supply-chain compromises. The attackers demonstrated:


  • Legitimate access to computational resources for parallel 2FA attempts
  • Knowledge of Dashlane's authentication workflow
  • Ability to obtain a list of target accounts

    • However, they were unable to:


  • Compromise Dashlane's internal systems or backup infrastructure
  • Obtain plaintext credentials from the servers
  • Scale the attack beyond 20 accounts before detection

    • ## Recommendations


    For Dashlane Users


  • Immediately: If you use Dashlane and received a compromise notice, change your master password and review for any unauthorized device registrations
  • Short-term: Enable any available secondary authentication factors (authenticator apps, hardware keys) on critical accounts stored in Dashlane
  • Ongoing: Use a unique, high-entropy master password and consider supplemental security for banking, email, and administrative accounts

    • For Dashlane


  • Migrate from numeric 2FA codes to authenticator-based TOTP or hardware security key support
  • Implement per-IP rate limiting on 2FA attempts rather than per-account limiting
  • Require re-authentication (not just 2FA) for device registration, particularly from new geographic locations
  • Provide users with security notifications when new devices are registered

    • For the Broader Community


  • Password manager providers should conduct regular 2FA security reviews and penetration testing
  • Users should view password managers as convenience tools with layered defenses, not as complete security solutions
  • Organizations should mandate unique, high-entropy master passwords in security policies
  • Industry should gradually deprecate short numeric 2FA codes in favor of stronger alternatives

    • ---


    ## HackWire Analysis


    This incident is significant not because it succeeded spectacularly—only 20 accounts compromised, encryption held—but because it succeeded at all and reflects a troubling trend in authentication attacks.


    For years, the security industry has marketed 2FA as the silver bullet for account security. "Enable two-factor authentication" has become the reflexive advice for every platform. Dashlane's attack reveals the practical limits of that guidance when 2FA implementation is weaker than users assume.


    The real story here is entropy collapse under automation. A six-digit numeric code has only one million combinations. With modern infrastructure, submitting one million requests in under a minute is trivial. Even with rate limiting, an attacker with distributed resources can try thousands of accounts in parallel, accepting a low success rate but expecting at least a few hits at scale. Dashlane's automatic account locking prevented wider damage, but the attack worked long enough to compromise 20 vaults.


    This pattern is accelerating across the industry. We're seeing similar brute-force approaches against Okta, Cisco, and Microsoft services—all targeting authentication codes or session tokens with low entropy. The shift reveals that attackers have largely abandoned password-level attacks against security-conscious targets (who use password managers and strong passwords) and are instead moving upstream to compromise the authentication layer itself.


    For defenders, the uncomfortable implication is that not all 2FA implementations are equally protective. A numeric code from an SMS or in-app notification is faster and easier to implement, but it's also faster and easier to attack than a TOTP token or hardware key. Organizations relying on these weaker 2FA variants should audit their systems for rate limiting, implement geographic anomaly detection, and plan migrations to stronger alternatives.


    For users with accounts in password managers vulnerable to this attack vector, the encryption layer became the actual security boundary—not the authentication layer. That's a humbling reminder that defense in depth is not optional. — *HackWire Editorial*


    ---


    ## Related Coverage


  • Read more in our [Breaches](https://www.hackwire.news/category/breaches) coverage
  • Cross-reference with [Vulnerabilities](https://www.hackwire.news/category/vulnerabilities) and [Authentication](https://www.hackwire.news/category/authentication)
  • Stay current via the [HackWire homepage](https://www.hackwire.news/)