unknownclosedpartial fix
Dashlane 2FA brute-force; encrypted vaults for <20 accounts
› Dashlane
Get an email when a new major security incident drops. No spam, unsubscribe any time.
- started
- May 31, 2026
- closed
- Jun 15, 2026
- CVEs
- none
- sources
- 1
## summary
Beginning May 31 2026 attackers brute-forced six-digit 2FA codes to register new devices on Dashlane accounts and downloaded encrypted vaults for fewer than 20 personal accounts. Dashlane said its own systems were not compromised and worked with affected customers.
severity: Account takeover attempt
## affected
- Accounts with 6-digit 2FA targeted in the campaign
## fixed in
no fixed release yet
## news & write-ups[1]
## notes & caveats
Verify primary vendor advisory for exact fixed versions; facts taken from public sources listed in links.
