Observed Signal · Jun 5, 2026 · Security Incident · Source: t3n · Impact: 2/5 · Sentiment: Negative
Dashlane Attack Steals Encrypted Password Vaults
Dashlane experienced a brute-force attack that abused its 'add new device' flow to request six-digit verification codes and send encrypted password vault copies to new devices. Attackers automated large numbers of API requests and used the three-hour validity window for codes to guess some codes by brute force. Dashlane detected and stopped the attack quickly; the company says fewer than 20 encrypted vaults were exfiltrated. Master passwords were not stored by Dashlane, so the stolen vaults remain encrypted and — according to Dashlane — effectively infeasible to decrypt without the users' master passwords.
A security breach of a major password manager highlights vulnerabilities in device‑onboarding and verification flows and has implications for identity and user-data protection, but impact appears limited (fewer than 20 vaults stolen and vaults remain encrypted).
Track TargetVideo Signals & Market Shifts in Real-Time
Polaris7 autonomous intelligence agents track regulatory filings, primary sources, executive changes, and deal flow 24/7. Create your free Explorer workspace to monitor these entities.
Key Takeaways & Evidence Grounding
- Cybercriminals performed a brute-force attack against Dashlane's device-registration API to obtain encrypted vault copies.
- Dashlane's device verification uses a six-digit code valid for three hours and is sent to a linked email or 2FA app.
- Attackers sent large volumes of requests and successfully cracked some verification codes despite the large search space.
- Dashlane detected and halted the attack quickly; fewer than 20 user vaults were stolen.
- Dashlane does not store users' master passwords, so stolen vaults remain encrypted and inaccessible without those passwords.
Connected Companies & Entities
2 Entities mappedRelated Market Signals & Shifts
Recent verified developments and strategic activity across this market segment.
LastPass Customer Data Stolen via Klue Breach
Password manager LastPass is handling a data breach after attackers accessed customer information by compromising a third‑party market intelligence platform, Klue. Klue detected unauthorized activity on 2026-06-12 and says attackers likely used old, compromised credentials for an integration service. Through that access, attackers viewed LastPass support tickets containing customer names, phone numbers, email addresses, home addresses, support-case details and sales-relevant information; payment data included in support tickets may also have been exposed. LastPass says its internal systems and user vaults were not compromised, and it is notifying affected users by email. Actions taken include suspending Klue employees’ access to LastPass data, rotating API access tokens, and planning additional protections. Users are advised to monitor payment activity and consider changing associated email addresses to reduce phishing risk.
Klue: 2022 Credential Used in Customer Data Breaches
Market research firm Klue confirmed that a credential issued in 2022 for a limited pilot was used by hackers in June 2026 to steal data from multiple corporate customers, including LastPass and several cybersecurity companies. Klue detected the intrusion on June 12, 2026, and disclosed the incident on June 23, 2026. Attackers leveraged access to Klue’s systems — which store OAuth tokens used to access customer data in other clouds and databases — to download data and extort impacted companies. Klue says the credential was originally provided to a third party for a pilot in 2022 but has not explained why it wasn’t revoked or what type of credential it was. A group calling itself Icarus claimed responsibility and threatened to publish the stolen data. Klue says it is conducting a comprehensive review of credential management, vendor access controls, monitoring and deployment security.
AI Agents Given Access to Password Vaults
The article warns that recent integrations allowing AI agents (LLMs) to access password managers create a new attack surface by moving credentials from a human-only trust boundary into a machine-reasoning trust boundary. While there are no reported widespread exploits yet, the author explains how prompt injection, tool-call confusion, or manipulated agent sessions could lead to credential misuse without a traditional compromise. The piece urges developers and security teams to treat agentic credential access as a present risk — scoping agent capabilities, enforcing task-specific and human-in-the-loop confirmations, and adding the capability to risk registers. It also raises an open question about how to classify and attribute accountability when an agent is manipulated into misusing credentials.
Track Real-Time Market Signals & Shifts
Set up custom watchlists to receive automated, evidence-grounded executive digests whenever material signals or shifts occur across your tracked landscape.