Dashlane Discloses Brute-Force Attack, Encrypted Vaults of Fewer Than 20 Users Downloaded
Summary: Dashlane disclosed that an unknown external actor launched a brute-force attack on May 31, 2026 against its device registration API endpoints, aiming to break 2FA and register new devices on existing accounts. The high volume of attempts triggered temporary account suspensions, but the attacker generated valid tokens for fewer than 20 personal plan users and downloaded copies of their encrypted vaults, which cannot be opened without the Master Password.
Key Takeaway: Fewer than 20 vaults were taken, but the attack worked by defeating the 6-digit device-registration token rather than the vault encryption itself - the same token flow that guards every account's new-device enrollment.
Read the original at The Hacker News ↗
- Topics
- Threat Actors & Nation-State
- Related
- University of Texas at Arlington warns personal information stolen during cyberattack Cyber Risks · Nov 13, 2026Hackers Exploit PHP2Shell Flaws in Check Point Gateways to Deploy TSGA Backdoor and Wipe ESXi Files Cyber Risks · Nov 13, 2026Hackers compromise 4,800 GitHub accounts to steal cloud credentials Cyber Risks · Nov 12, 2026