Dashlane reports 2FA breach, encrypted vaults downloaded

Created at 3 Jun · 12:21 AM3 sources↑ Market-relevant3 events

IN SHORT

Password manager Dashlane disclosed a breach where attackers bypassed 2FA via brute force, compromising fewer than 20 accounts and downloading encrypted vaults. The incident began May 31, triggering lockouts for other targeted users.

Key Numbers

fewer than 20personal plan user accounts compromised

May 31attack start date

Who's Involved

Dashlane

Password manager provider that disclosed the breach

external attacker

Perpetrator of the brute-force attack

↳ Why This Matters

This incident raises concerns about the security of password managers and the effectiveness of their two-factor authentication systems, potentially impacting user trust and data security.

Key facts

Attackers successfully brute-forced Dashlane's two-factor authentication system.
The breach affected fewer than 20 personal plan user accounts.
Attackers downloaded encrypted password vaults from the compromised accounts.
The incident began on May 31 and led to automatic account lockouts for other targeted users.

Password manager Dashlane announced that an external attacker successfully bypassed its two-factor authentication (2FA) system through a brute-force attack. The breach, which commenced on May 31, affected fewer than 20 personal plan user accounts. As a result of the attack, the perpetrators were able to download copies of the encrypted password vaults belonging to these compromised accounts. The incident also led to automatic account lockouts for a broader group of users who were targeted by the attackers. Dashlane stated that the downloaded vaults remain encrypted and that the company is working with affected users to help them secure their accounts and reset their passwords. A user who received a 2FA request provided a screenshot of the notification received on Sunday.

FREQUENTLY ASKED

Hackers successfully brute-forced Dashlane's two-factor authentication system and downloaded encrypted password vaults from fewer than 20 user accounts.

Fewer than 20 personal plan user accounts were compromised.

The hackers downloaded encrypted password vaults from the affected accounts.

The attack began on May 31.

Key facts

Attackers successfully brute-forced Dashlane's two-factor authentication system.

The breach affected fewer than 20 personal plan user accounts.

Attackers downloaded encrypted password vaults from the compromised accounts.

The incident began on May 31 and led to automatic account lockouts for other targeted users.

Dashlane reports 2FA breach, encrypted vaults downloaded

PiQ Daily

Key facts

Dashlane reports 2FA breach, encrypted vaults downloaded

PiQ Daily

Key facts

Get the newsletter.