Key facts
- Attackers downloaded fewer than 20 encrypted password vaults from Dashlane.
- The attack targeted Dashlane's device enrollment mechanism.
- Attackers used brute-force methods on API endpoints for device registration.
- Dashlane's security systems triggered account lockouts.
- The campaign began on Sunday and was mitigated by Thursday.
Password manager Dashlane has detailed how attackers managed to download fewer than 20 encrypted password vaults in a coordinated campaign. The attackers exploited Dashlane's device enrollment process, targeting API endpoints for device registration and employing brute-force attacks to generate valid tokens. Dashlane's automated security systems detected the activity and initiated account lockouts, but not before the threat actor successfully accessed and downloaded a small number of encrypted vaults. The campaign, which began on Sunday, was mitigated by Thursday. This incident underscores the persistent threats to sensitive user data stored in password managers and the sophisticated methods employed by malicious actors.