Can't make sense of Dashlane's vault theft notification? You're not alone.

Dashlane disclosed that beginning May 31, 2026, an external party launched a brute-force attack targeting two-factor authentication on certain user accounts, enabling the attacker to register new devices and access 20 encrypted user vaults; users reported receiving unexpected 2FA requests and criticized Dashlane's communication. The report examines the mechanics and feasibility of brute-forcing six-digit time-based codes (noting an unusually long three-hour code validity in at least one case), questions around rate limiting and server load, and community concern about the scope and handling of the incident.