Cannot make sense of Dashlane’s vault theft notification? You are not alone.

There’s loads that doesn’t add up in a safety advisory password supervisor Dashlane revealed Monday, warning that attackers managed to acquire 20 encrypted consumer vaults.

“Beginning on Sunday, Might 31, 2026, an exterior occasion launched a brute power assault in opposition to sure Dashlane consumer accounts,” the corporate stated. “The objective of the assault was to brute-force two-factor authentication (2FA) protections to permit the attacker to register new gadgets on present consumer accounts.”

Good day, Dashlane, anyone dwelling?

A Dashlane consumer who acquired such a 2FA request offered this screenshot of the notification, which arrived on Sunday.

The UK-based consumer was involved and contacted Dashlane by way of a assist bot. In the end the consumer received no details about why the notification was despatched.

“Then [I] found this information from Mastodon infosec and never Dashlane themselves,” the consumer advised me. “At the moment looking for out what has occurred! As a result of how are you going to set off a 2fa request when you haven’t received the password 1st? As a paying buyer I feel I ought to have identified about this from Dashlane and never Mastodon infosec people.”

Scores of social media discussions are crammed with related feedback from customers who additionally don’t perceive the fundamental mechanics of this assault. Usually, 2FA protections take the type of a one-time password generated by an authentication app or despatched by textual content or e-mail. They’re usually six digits lengthy and alter each 45 or so seconds, though because the notification above signifies, the code remained legitimate for 3 hours.

Brute-forcing is a trial-and-error technique that quickly submits each potential mixture till touchdown on the fitting one. Beneath these assumptions, there could be 1 million potential passcodes. A profitable breach would require a statistically important share of them to be entered inside the three-hour window.

Whereas the sources wanted to bombard Dashlane servers with that quantity of guesses in such a brief time frame are potential, they’re not generally present in normal brute-force assaults. Dashlane doesn’t explicitly say it positioned a fee restrict on the variety of submissions a consumer could make, though it seems probably based mostly on language within the advisory saying “Due to the excessive quantity of makes an attempt on consumer accounts, Dashlane’s safety controls routinely locked accounts that had been focused by the assault.” Even assuming there was no fee limiting, it’s exhausting to think about Dashlane servers not no less than quickly choking when receiving 150,000 or extra submissions in an hour or so.