Your personal files are only as secure as the credentials protecting them.
That’s not an abstract concern. In February 2026, researchers from ETH Zurich and the Università della Svizzera italiana published a study identifying 27 distinct attack paths against three of the world’s most popular password managers: Bitwarden, LastPass, and Dashlane. The research, which covered roughly 60 million combined users, revealed that the “zero-knowledge” architecture these services advertise is harder to deliver than it sounds.
For anyone storing sensitive personal files, health records, or private media in the cloud, this research is directly relevant. Your cloud storage account is protected by a password. That password is almost certainly in a password manager. And that password manager may be more exposed than you realised.
What the ETH Zurich Research Found
The research team framed their work around a specific threat model: a malicious server — meaning, what happens if the server your password manager syncs to is compromised or behaves adversarially?
Under this model, they identified 27 attack categories across three services:
- Bitwarden: 12 distinct attack paths, ranging from integrity violations to full vault compromise in some configurations
- LastPass: 7 attack paths
- Dashlane: 6 attack paths
These attacks don’t require you to make an obvious error. They exploit weaknesses in how services verify the integrity of encrypted data returned to your client, or how authentication flows behave under adversarial server conditions.
This directly undermines a core promise: that even the service provider cannot access your passwords. Under adversarial server conditions, that promise doesn’t fully hold.
What “Zero-Knowledge” Actually Guarantees
Zero-knowledge architecture means the service stores your passwords encrypted with a key derived from your master password. In theory, only you can decrypt your vault. Even if the service’s servers are breached, attackers get only ciphertext — useless without your master password.
The ETH Zurich research shows this model has meaningful gaps. A server operating adversarially can, in certain conditions, manipulate what it sends back to your client in ways that undermine vault integrity or expose individual credentials. The model is substantially stronger than no encryption — but it’s not the absolute guarantee the marketing implies.
All three vendors responded. Bitwarden acknowledged ten issues, noted seven were addressed or in progress, and accepted three as intentional design decisions. LastPass and Dashlane stated no exploitation had been observed in the wild. None of these responses are dismissive, but “no observed exploitation” is a limited reassurance given how breaches typically unfold.
Why This Cascades to Your Cloud Files
Most discussions of cloud storage security focus on the provider — what encryption they use, who holds the keys, what their terms of service grant them access to. That focus is correct. But there’s a second layer almost nobody thinks about: how you authenticate to your cloud storage in the first place.
The answer, for most people, is a password stored in a password manager.
If your password manager is compromised — through a vault breach, a phishing attack, or one of the vulnerability classes this research describes — an attacker gains the credentials to your cloud storage account. From there, they can:
- Access, download, and copy your files
- Delete files or your entire account
- Change your account password and lock you out permanently
- Exfiltrate data silently before you detect anything
The chain matters as much as any individual link. Robust cloud-side encryption doesn’t protect you if the credentials for accessing your account are exposed. An attacker using your valid credentials is, from your storage provider’s perspective, you.
The 2022 LastPass Breach as a Case Study
The clearest recent example is the LastPass breach of 2022, the full consequences of which are still being traced.
Attackers obtained encrypted vault data for millions of users. The encryption was as strong as each user’s master password. For users with weak master passwords, offline brute-force attacks on the stolen ciphertext proved effective. Credentials from those decrypted vaults were subsequently used to drain cryptocurrency wallets, access financial accounts, and compromise cloud storage.
The LastPass breach wasn’t caused by a formally published vulnerability. It started with a compromise of a developer’s home computer, which gave attackers access to a shared credential used for LastPass’s development environment. The chain from that initial compromise to millions of exposed vaults took months and multiple steps.
This illustrates why “no publicly documented vulnerability” doesn’t mean “no attack surface.” Real breaches tend to exploit combinations of weaknesses, not single textbook vulnerabilities.
The Specific Risk to Personal File Archives
When a password manager breach exposes cloud storage credentials, the consequences differ meaningfully from a credit card breach.
A credit card number can be cancelled and reissued. The damage is financial and remediable. Your personal files — documents, photos, medical records, private correspondence, financial history — cannot be un-leaked. Once an attacker has downloaded your files, that exposure is permanent regardless of what happens afterward.
This asymmetry makes protecting cloud storage credentials particularly high-stakes.
What a Credential Attack Looks Like
- Attacker compromises a password manager vault through breach, phishing, or an exploitation of the vulnerability classes identified in the ETH Zurich research
- Attacker extracts stored credentials for cloud storage service
- Attacker authenticates using valid username and password — no anomaly to detect
- Attacker downloads target files silently
- Attacker may optionally lock the legitimate user out by changing account password
The cloud storage provider’s AES-256 encryption at rest is entirely irrelevant in this scenario. The attacker is an authenticated user. The decryption happens as part of normal authorised access.
Practical Mitigations That Help
The goal isn’t to abandon password managers. They remain a substantial improvement over password reuse or memorising credentials — or writing them on sticky notes. The goal is to use them with a clear understanding of their attack surface.
Use a Strong, Unique Master Password
The most important single action. A password manager vault is only as strong as the master password encrypting it. If your master password is short, reused, or has appeared in any prior breach, your vault is vulnerable to offline brute force if vault data is ever obtained.
A strong master password is long (20+ characters), mixes character types, and has never appeared in a breach dataset. Check it against haveibeenpwned.com before trusting your vault security.
Enable Multi-Factor Authentication
MFA protects against credential theft where an attacker has your master password but not your physical device. Even a compromised master password can’t open your vault without the second factor.
Use an app-based TOTP authenticator or a hardware security key. SMS-based MFA is vulnerable to SIM-swapping and offers significantly weaker protection.
Compartmentalise Your Highest-Value Accounts
Not every credential needs to be in your password manager. Consider keeping the credentials for your most sensitive services — primary email, financial accounts, cloud storage holding private data — outside your main vault, managed with a separately secured method.
A hardware security key (like a YubiKey) paired with a unique, memorised passphrase for a small number of critical accounts adds a layer that doesn’t depend on your password manager’s integrity.
Understand What Open-Source and Local-First Options Offer
Open-source password managers allow independent researchers to audit the codebase. The ETH Zurich research itself was possible partly because Bitwarden is open source — the team could inspect the implementation, not just test black-box behaviour.
Local-first managers like KeePass store vault data on your own device rather than syncing to a remote server. This eliminates the server-side attack surface entirely, at the cost of sync convenience across devices.
What to Look for in a Cloud Storage Provider
Given that credential compromise is a concrete threat, some storage provider features can meaningfully limit blast radius.
Session management and visibility: Can you see all active authenticated sessions and terminate ones you don’t recognise? Providers that expose session lists — showing device, location, and login time — let you detect unauthorised access before an attacker finishes exfiltrating.
Login notifications: Email or push alerts when a new device logs in give you a detection window. Some attacks take time to exfiltrate large collections. An early notification may let you revoke access before the job is done.
No third-party data sharing: Even in a legitimate compromise scenario, providers who don’t sell or share data with third parties limit what an attacker can do with account metadata.
Permanent data erasure on deletion: A provider that irreversibly erases your data after account closure ensures that a compromised-then-closed account leaves no residual exposure. Data that no longer exists can’t be accessed, regardless of how credentials were obtained.
Clear ownership of your data: Providers whose terms explicitly state they will never use your content to train AI models or share it for commercial purposes have less incentive to retain copies of your data beyond what you’ve stored.
The Broader Security Chain
This post has focused on password managers as a specific vulnerability surface, but the underlying principle extends further.
Every service that holds credentials to your cloud storage is a potential weak link: your email account (used for password resets), your phone number (used for SMS-based MFA), your browser (where credentials may be autocompleted), your devices (where sessions may be cached).
Security professionals talk about “defence in depth” — layering protections so that no single compromise leads to total exposure. For personal file storage, that means:
- Strong, unique master password for your password manager
- MFA on the password manager itself
- MFA on your cloud storage account
- Login notifications enabled
- Periodic review of active sessions
- Separate, memorised credentials for highest-value accounts
None of these steps are individually sufficient. Together, they create a chain that requires multiple simultaneous failures for an attacker to succeed.
The February 2026 research is a reminder that the components of that chain deserve scrutiny. The password manager you’ve trusted for years may have surfaces you haven’t thought about. Understanding those surfaces is the starting point for managing them.
The Takeaway
Password managers are not an attack vector you can ignore when thinking about cloud storage security. The research from ETH Zurich and USI demonstrates that even the most widely trusted password managers have meaningful attack surfaces under adversarial conditions.
Your cloud files are only as secure as the complete access chain: your master password, your MFA setup, the integrity of the password manager software, and the practices of the cloud provider.
Strengthening one link without attending to the others leaves gaps. The 2022 LastPass breach demonstrated what those gaps look like at scale. The February 2026 research demonstrates they haven’t fully closed.