Dashlane users got a rude reminder that even tools built to protect you can be attacked; a recent brute-force campaign targeted a small group of accounts and managed to download encrypted vaults. This piece walks through what happened, why those encrypted files matter, and practical steps to lock down your password manager or move your data out of it. You’ll get clear advice on hardening access, exporting your vault safely, and what to do before you delete anything. Read on for a brisk, no-nonsense guide to staying one step ahead after a hit like this.
Password managers hold the keys to your digital life, which makes any breach a serious worry. Dashlane recently faced a brute-force attack that focused on a subset of accounts, and while its internal systems weren’t compromised, attackers did manage to download encrypted vault files from affected profiles. Encrypted data is far safer than plaintext, but stolen vaults still put pressure on users to tighten their defenses immediately.
Brute-force attacks are the cyber equivalent of turning the tumbler on a lock until it opens, and this incident also tried to undermine two-factor authentication by slipping in additional compromised devices. The attack volume was large enough that Dashlane’s systems flagged and temporarily locked targeted accounts, but not before some vaults were pulled down. That mix of speed and persistence is exactly why account hygiene matters more than ever.
Dashlane says fewer than 20 accounts were affected and that impacted users were notified and locked out while the company investigated. If you didn’t receive that notification, your account was likely not among the breached set. Still, breaches are a reminder to assume risk and act accordingly rather than wait to see if you get an email.
Dashlane claims that it has “deployed additional protections at the network level and within the product to further detect and filter out malicious traffic,” and the company says suspended accounts have been restored while its team works to prevent repeat attempts. That sentence is the company’s public posture, but technical fixes are only one part of security—users must also take practical steps to reduce their exposure. Treat any breach notice as a trigger to review authentication and password strength right away.
Start with the basics: change your master password and do it regularly, every six to twelve months, or sooner if you suspect anything odd. Make that password long and random; brute-force attackers grind through simple or short passwords first, so length and unpredictability matter more than clever phrases. Finally, enable two-factor authentication and keep whatever second factor you use under tight control so attackers can’t add devices or spoof approvals.
If you’re not comfortable staying with Dashlane after an incident, export your data to a CSV file as a portable record of your logins before doing anything irreversible. Open that CSV and confirm every entry is present; once you delete your Dashlane account, that file may be the only copy of your passwords. Treat the CSV like a highly sensitive document while it exists—don’t leave it unprotected on a desktop or in plain cloud storage.
When you take the CSV route, delete your Dashlane vault through the account deletion flow on a computer after you’ve verified the export is complete. Store the CSV in a password-protected container or import it into another reputable manager, with options such as Proton Pass, 1Password, NordPass, and LastPass being among the common choices. Whatever path you choose, do not store them in an unprotected text file on your computer; that’s riskier than many people realize and could undo the purpose of moving your data in the first place.
