Password manager maker Dashlane disclosed that hackers obtained at least a dozen encrypted vaults used for storing customer passwords during a weekend cyberattack. Dashlane said hackers brute-forced the company’s two-factor authentication system, granting access to about 20 customer accounts, and were able to download a copy of the encrypted vaults.

A password manager breach is the security industry’s worst-case scenario it is the one product whose entire value proposition is protecting everything else. Even with encryption in place, attackers with the vaults now have unlimited time to attempt offline cracking against master passwords. Users who reused their master password anywhere, or who chose a weak one, are fully exposed.

This breach also proves that not all 2FA implementations are equal brute-forcing a 2FA system means the rate limiting, lockout policies, and authentication logic were insufficient. If you use Dashlane: change your master password immediately, enable the strongest available 2FA method, and rotate every critical credential in your vault.