On May 31, 2026, attackers launched a brute-force campaign against Dashlane user accounts, triggering automated lockouts across both enterprise and consumer accounts. The core business risk extends beyond the lockouts themselves: a successfully compromised Dashlane master account exposes every credential stored in that vault, potentially granting attackers access to all enterprise systems whose passwords are managed there. Limited public disclosure from Dashlane means security teams cannot yet determine full campaign scope or confirm whether any vaults were accessed.