Dashlane: Hackers bypassed 2FA, copied about 20 encrypted vaults

Password manager Dashlane reported an attack that began on Sunday, May 31, in which attackers brute‑forced two‑factor authentication (2FA) to register new devices on existing accounts and copy encrypted vaults from about 20 personal plan users. Affected customers have been notified; the company says vault contents cannot be decrypted without the users’ Master Passwords.

According to Dashlane, the incident started with a high‑volume campaign that repeatedly attempted to bypass the service’s 2FA protections. The volume of attempts triggered the service’s automatic security locks on targeted accounts, but attackers were able to register new devices on a subset of accounts and download a copy of the encrypted vault to those devices.

When a user adds a device, Dashlane sends a one‑time six‑digit token to the account’s registered email. For users who enable 2FA, the process also requires a six‑digit code from an authentication app. After device registration, Dashlane downloads an encrypted copy of the user vault to the device; that copy can only be decrypted with the account’s Master Password.

Dashlane reports attackers succeeded in copying encrypted vaults for roughly 20 personal plan users. Some customers were temporarily blocked from adding new devices or from logging in with 2FA while automated protections acted. The company says all affected users have been contacted.

The company described its encryption as the primary safeguard: “Dashlane vault data cannot be accessed without the Master Password, and our vault encryption ensures that any attempts to gain access to the vault are statistically unlikely to succeed, even over a long period of time,” the company wrote. Dashlane uses Argon2 and AES‑256‑CBC with HMAC‑SHA256 and does not store Master Passwords or their derivatives under its zero‑knowledge architecture. The firm also reported no evidence that its internal systems were impacted.

In response, Dashlane deployed additional protections at the network level and within the product to better detect and filter malicious traffic. The company plans to add extra verification steps to the new device registration flow and advised users to review registered devices and remove any they do not recognize. Users who have not enabled 2FA were urged to turn it on.

Dashlane said there is no need to change credentials or update Master Passwords unless a Master Password is weak or easily guessed. The company continues to investigate the attack and monitor for related activity as it implements the added safeguards.