Password manager Dashlane revealed that hackers gained access to at least 20 encrypted customer vaults, storing sensitive credentials. The hackers brute-forced the two-factor authentication (2FA) system, a serious breach as this usually prevents unauthorized access.

Though there is no evidence of Dashlane’s own systems being compromised, questions remain about how the 2FA protections were overcome and if these customers were targeted specifically. Only those with easily guessable master passwords may be at higher risk, according to Dashlane.

Data breaches in password manager companies are rare but can have severe consequences. In 2022, LastPass experienced a similar attack where hackers brute-forced early customer vaults due to weaker initial security standards. Such incidents highlight the perpetual struggle between cybersecurity and human fallibility.

The company has notified affected customers but hasn’t disclosed steps taken to mitigate future risks. Dashlane’s spokesperson did not respond to requests for further information, leaving many questions unanswered about the nature of this attack and who may be behind it.