Dashlane just told a portion of its customers their encrypted password vaults walked out the door. The intruders did not exploit a zero-day. They did not pivot through a supply chain. They guessed master passwords until enough worked, and then they downloaded what came back.

This is the cybersecurity story that should be getting more attention than it is. While the industry keeps publishing breathless reports on agentic AI worms and clearance-house procurement plays at CISA, the actual breaches landing in June 2026 look a lot like 2016. Internet-facing authentication surfaces are losing to brute-force attempts, and the unauthenticated stuff sitting on the public internet is losing even faster.

The pattern this week is hard to miss. Dashlane’s brute-force incident overlapped with researchers finding more than 900 US fuel-station tank gauges open to the internet with no meaningful authentication at all, and with ReliaQuest reporting a previously unknown threat cluster, OP-512, planting custom web shells on internet-facing Microsoft IIS servers. The middle of the funnel is the same in every case. You exposed an authentication or admin surface, and the attackers did the rest.

A vault is only as strong as the master password

Dashlane’s disclosure deserves an honest reading. The company says its internal systems were not breached. What attackers got was a slice of customer vaults via repeated login attempts against accounts whose master passwords were either weak, reused, or already exposed in prior breaches. The encryption held at the moment of theft. It is being chipped at right now on attacker hardware.

That is the situation every password manager customer should understand. Stolen encrypted vaults are a race. The clock starts when the attacker downloads the file, not when the vendor sends the breach email.

Long, unique master passwords with high-entropy structure are not optional anymore, and neither is MFA at the vault login. If your master password is twelve characters with a couple of substitutions, treat it as already cracked. Rotate everything stored inside the vault that matters, starting with email, IdP, and financial accounts, and do it this week.

The unauthenticated internet is still the internet

Then there are the things that never had a password to crack in the first place. The 900-plus automatic tank gauge systems exposed across US fuel sites are connected to physical infrastructure that controls level sensors, leak alarms, and fuel inventory. Some can write configuration. Some can affect the readings that get reported upstream to operators who think the tanks are full when they are not.

How did the gas stations end up on the internet? The way everything ends up on the internet. Somebody needed remote monitoring, a maintenance vendor wanted Serial-over-IP access, and nobody ever closed the port when the vendor rotated out.

OP-512 is the other shoe. ReliaQuest’s analysis describes a China-linked espionage cluster that drops a bespoke web shell framework on IIS servers reachable from the public internet. The web shell is the easy part. The hard part, getting an attacker into a position to drop one, only requires an exposed admin surface and either a known exploit chain, stolen credentials, or, again, a brute-force pass on whatever is listening.

Threat detection that fires only when malware lands on a workstation will never see this kind of activity. The fight is at the perimeter, where it has always been, except the perimeter is now everything you forgot you put online.

What to do this week

The defense in depth playbook here is mundane, and that is the point. Mundane controls, executed honestly, would have blocked most of what hit the news this week.

Here is the short list worth running through before Friday.

• Inventory every internet-facing authentication surface you own. VPN, RDP, SSH, IIS, OWA, vendor portals, ICS gateways, ATG systems, anything that answers on a public IP. If you cannot list them in a spreadsheet by tomorrow, you do not control them.
• Put real brute-force controls on every one of those surfaces. Account lockout after a low threshold of failures, IP-based throttling, geo restrictions where business permits, and alerting on credential spray patterns across the user population, not just per account.
• Make MFA non-optional on password manager logins, email, IdP, and remote access. Push-only is not enough anymore. Phishing-resistant factors where you can get them.
• Force a master password rotation for any user whose vault or credentials may have been involved in a vendor incident in the last 12 months. Default to suspicion.
• Get rid of unauthenticated services on the public internet. Whatever the maintenance contractor told you about needing direct access, it is wrong. Front it with a VPN, a reverse proxy with auth, or take it off the internet entirely.
• Rehearse the incident response playbook for stolen vaults. Who notifies users, who rotates the high-value secrets, what gets revoked, in what order. Do not write it during the breach.

Security hardening is not exciting. It also still works. The teams that will come out of this week intact are the ones that already did the boring stuff.

The teams that will not are the ones still waiting for a vendor to ship them a feature that fixes inattention.

Sources

• Attackers obtained encrypted password vaults from some Dashlane user accounts (Help Net Security)
• Over 900 US gas station tank gauge systems exposed to attacks (BleepingComputer)
• New Threat Cluster OP-512 Targets Microsoft IIS Servers with Custom Web Shell Framework (The Hacker News)