DEV Community

Kokal Limited
Kokal Limited

Posted on • Originally published at strongpassfactory.com

What Devs Should Learn From the Dashlane Brute-Force Attack

#passwordsecurity #onlinesafety #cybersecurity

On May 31, 2026, Dashlane got hit with a coordinated brute-force attack that locked thousands of users — including team-plan customers — out of their vaults during work hours. Dashlane confirmed to BleepingComputer that automated controls suspended targeted accounts. No internal systems were breached, and accounts were restored. But if your team depends on a password manager, this is worth a look.

The actual attack vector: credential stuffing

The attack wasn't some exotic zero-day. It was credential stuffing — replaying leaked email/password pairs against a high-value login endpoint. It works because of one stubborn human habit: password reuse.

Attackers pull credential pairs from breach dumps and script them against a target:

# Conceptually, what an attacker's loop looks like
for email, password in leaked_credentials:
    r = session.post("https://vault.example.com/login",
                     data={"email": email, "password": password})
    if r.status_code == 200:
        log_hit(email)  # reused password → account compromised
Enter fullscreen mode Exit fullscreen mode

Per Verizon's 2024 DBIR, 43% of cyberattacks target small businesses, and only 14% are prepared. A locked password manager isn't a minor annoyance — it means no access to shared vaults, client creds, or infra secrets mid-incident.

Defense: what you can actually configure

If you administer a team plan, MFA enforcement is the single highest-leverage control. Credential stuffing dies instantly when a second factor is required:

# The policy posture you want on any team password manager
mfa:
  enforcement: required      # not "optional"
  methods: [totp, webauthn]  # prefer hardware/WebAuthn over SMS
lockout:
  policy: admin-configurable # not vendor-locked
  admin_override: true       # someone can unlock a locked-out director
audit_logging: full
Enter fullscreen mode Exit fullscreen mode

Consumer plans give you vendor-defined lockout and optional MFA. Business tiers (1Password Teams, Keeper Business, LastPass Business) let you mandate MFA, configure lockout, and unlock accounts as an admin.

A short checklist for engineers

  • Enforce MFA — prefer WebAuthn/TOTP over SMS. This alone neutralizes credential stuffing.
  • Document recovery — designate a backup admin who can override lockouts. Don't let one locked account halt the team.
  • Audit reused passwords — run your team through Have I Been Pwned or your manager's built-in breach report.
  • Rate-limit your own login endpoints — if you ship auth, the same attack applies to you.

The uncomfortable takeaway: even a well-built password manager can be knocked offline by attackers weaponizing your users' reused passwords. MFA and a documented recovery path are what keep a Tuesday-morning attack from becoming a Tuesday-morning outage.

Originally published on StrongPassFactory.

Top comments (0)