Dashlane Says Attackers Downloaded Fewer Than 20 Encrypted Vaults
Summary
Dashlane says attackers brute-forced 2FA to register devices on targeted accounts and downloaded encrypted vaults from fewer than 20 personal-plan users. The company says the accounts were locked, affected users notified, and there is no evidence its internal systems or
Key points
- Dashlane says the campaign began May 31, with attackers trying numeric combinations to brute-force 2FA codes and register their own devices on targeted accounts.
- Device registration enabled vault downloads; attackers obtained encrypted vault copies from fewer than 20 personal-plan users.
- Dashlane says it detected the activity, automatically locked targeted accounts, later restored them, and notified affected users.
- The company says vault data cannot be accessed without the master password and that there is no evidence its internal systems were impacted.
Article Details
- Victim Organization
- Dashlane
- Incident Type
- Brute-force attack against two-factor authentication, resulting in some account compromises and downloads of encrypted vaults.
- Data Types Exposed
- Encrypted vault data
- Affected Records
- Fewer than 20 personal plan users' encrypted vaults were downloaded.
- Operational Impact
- Targeted accounts were automatically locked. Dashlane later restored the locked accounts and notified affected users. Dashlane reported no evidence that its internal systems were impacted.
- Claim Status
- confirmed