[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fd4Bx1HY5vHx5ba76vPspl9prq8f3b1xSmLa3Mlh6S60":3},{"article":4,"iocs":39,"watch_terms":44,"solutions":45,"lesson":129},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":23,"category":24,"article_tags":28},"7aa39c1e-c41a-4811-8611-210a20bc65a1","Dashlane Discloses Brute-Force Attack, Encrypted Vaults of Fewer Than 20 Users Downloaded","dashlane-discloses-brute-force-attack-encrypted-vaults-of-fewer-than-20-users-do-a5436f","Password manager Dashlane has disclosed that \"fewer than\" 20 users on the personal subscription plan had their encrypted vaults downloaded following a brute-force attack launched by an unknown party. On May 31, 2026, the company said an \"external\" threat actor launched a brute-force attack against certain Dashlane user accounts with the aim of breaking two-factor authentication (2FA)","Password manager Dashlane disclosed that an external threat actor conducted a brute-force attack against user accounts on May 31, 2026, targeting two-factor authentication protections to register unauthorized devices. The attackers successfully compromised fewer than 20 personal plan users' encrypted vaults, though the data remains protected by Master Passwords. Dashlane's internal systems were unaffected, and affected users have been directly notified.","Dashlane discloses brute-force attack compromised encrypted vaults of fewer than 20 users.","https:\u002F\u002Fthehackernews.com\u002F2026\u002F06\u002Fdashlane-discloses-brute-force-attack.html","https:\u002F\u002Fblogger.googleusercontent.com\u002Fimg\u002Fb\u002FR29vZ2xl\u002FAVvXsEjMY3oQNaqfV2_sMYMZJ_EbUA90VD_t0w342aOV-tTDXEui63NgSB0SPYPhGVW9e5i8ZcEk7P5uudw6PJOi5od9rdsq9GzG0npc8FiqXuQ33r-zg81AMHW53prz_ovs2YbKrjaNfOOAp1tpmjhE3ADsjVymKPDGf4TyikPb1z18MOWk2YH-BteUQ6EUqYFI\u002Fs1600\u002Fdashlane.png","2026-06-02T03:55:25+00:00","2026-06-02T06:00:17.658806+00:00",7,[17,20],{"name":18,"type":19},"Dashlane","product",{"name":21,"type":22},"Two-Factor Authentication (2FA)","technology","2e06f76c-d5b9-4f54-9eef-4d3447b10730",{"id":23,"icon":25,"name":26,"slug":27},null,"Breaches","breaches",[29,34],{"category":30},{"id":31,"icon":25,"name":32,"slug":33},"2c8f44d4-b56e-47cf-9677-04f22c9ee78d","Identity & Access","identity-access",{"category":35},{"id":36,"icon":25,"name":37,"slug":38},"614132b8-5837-4952-b8b5-c6c9a32a1d85","Privacy","privacy",[40],{"type":41,"value":42,"context":43},"malware","brute-force attack","Automated attack against Dashlane user accounts targeting 2FA bypass on May 31, 2026",[18],{"controls":46,"vendors":128},[47,76,102],{"slug":48,"name":49,"problem":50,"products":51},"phishing-resistant-mfa","Phishing-resistant MFA","A stolen password, or a user who taps Approve on a push prompt, is no longer enough to log in.",[52,60,68],{"vendor_slug":53,"vendor_name":54,"vendor_logo":55,"product_slug":56,"product_name":57,"url":58,"description":59},"yubico","Yubico","\u002Fvendor-logos\u002Fyubico.png","yubikey","YubiKey","https:\u002F\u002Fwww.yubico.com\u002Fproducts\u002F","Hardware security keys for FIDO2, passkeys and smart card login, in USB and NFC versions.",{"vendor_slug":61,"vendor_name":62,"vendor_logo":63,"product_slug":64,"product_name":65,"url":66,"description":67},"microsoft","Microsoft","\u002Fvendor-logos\u002Fmicrosoft.png","entra-id","Microsoft Entra ID","https:\u002F\u002Fwww.microsoft.com\u002Fen-us\u002Fsecurity\u002Fbusiness\u002Fidentity-access\u002Fmicrosoft-entra-id","Cloud identity and access management with single sign-on, conditional access, passkeys and identity governance.",{"vendor_slug":69,"vendor_name":70,"vendor_logo":71,"product_slug":72,"product_name":73,"url":74,"description":75},"okta","Okta","\u002Fvendor-logos\u002Fokta.png","workforce-identity","Okta Workforce Identity","https:\u002F\u002Fwww.okta.com\u002Fproducts\u002Fworkforce-identity\u002F","Single sign-on, adaptive MFA including phishing-resistant methods, and lifecycle management for employees.",{"slug":77,"name":78,"problem":79,"products":80},"identity-threat-detection","Identity threat detection and response (ITDR)","Attackers who log in with real, stolen credentials get noticed.",[81,86,94],{"vendor_slug":69,"vendor_name":70,"vendor_logo":71,"product_slug":82,"product_name":83,"url":84,"description":85},"identity-threat-protection","Okta Identity Threat Protection","https:\u002F\u002Fwww.okta.com\u002Fproducts\u002Fidentity-threat-protection\u002F","Continuous risk assessment of sessions after login, with automatic actions such as ending sessions.",{"vendor_slug":87,"vendor_name":88,"vendor_logo":89,"product_slug":90,"product_name":91,"url":92,"description":93},"acalvio","Acalvio","\u002Fvendor-logos\u002Facalvio.png","shadowplex-identity-protection","ShadowPlex Identity Protection","https:\u002F\u002Fwww.acalvio.com\u002Fproducts\u002Fidentity-protection\u002F","Decoy accounts and credentials that expose identity attacks and credential misuse early.",{"vendor_slug":95,"vendor_name":96,"vendor_logo":97,"product_slug":98,"product_name":99,"url":100,"description":101},"vectra-ai","Vectra AI","\u002Fvendor-logos\u002Fvectra-ai.png","vectra-ai-platform","Vectra AI Platform","https:\u002F\u002Fwww.vectra.ai\u002Fplatform","Detection of attacker behaviour across network, identity and cloud.",{"slug":103,"name":104,"problem":105,"products":106},"encryption-key-management","Encryption and key management","Stolen data stays unreadable, and the keys stay under your control.",[107,115,123],{"vendor_slug":108,"vendor_name":109,"vendor_logo":110,"product_slug":111,"product_name":112,"url":113,"description":114},"thales","Thales","\u002Fvendor-logos\u002Fthales.png","luna-hsm","Thales Luna HSM","https:\u002F\u002Fcpl.thalesgroup.com\u002Fencryption\u002Fhardware-security-modules","Hardware security modules for protecting cryptographic keys.",{"vendor_slug":116,"vendor_name":117,"vendor_logo":118,"product_slug":119,"product_name":120,"url":121,"description":122},"hashicorp","HashiCorp","\u002Fvendor-logos\u002Fhashicorp.png","vault","HashiCorp Vault","https:\u002F\u002Fwww.hashicorp.com\u002Fen\u002Fproducts\u002Fvault","Secrets management with short-lived credentials and encryption as a service.",{"vendor_slug":108,"vendor_name":109,"vendor_logo":110,"product_slug":124,"product_name":125,"url":126,"description":127},"ciphertrust","CipherTrust Data Security Platform","https:\u002F\u002Fcpl.thalesgroup.com\u002Fencryption\u002Fdata-security-platform","Data discovery, encryption and central key management across on-premises and cloud.",[],{"slug":130,"title":131,"body":132,"framework_refs":133,"framework_notes":140},"brute-force-attack-bypasses-2fa-controls-at-password-manager","Brute-Force Attack Bypasses 2FA Controls at Password Manager","Dashlane experienced a brute-force attack that successfully bypassed two-factor authentication protections, allowing attackers to register unauthorized devices and access encrypted user vaults. While fewer than 20 users were affected and the data remains encrypted with Master Passwords, this incident highlights critical weaknesses in authentication controls and attack detection. The breach demonstrates that even security-focused companies must implement robust rate limiting, device registration controls, and real-time monitoring to prevent credential-based attacks. Organizations using password managers should recognize that these services remain high-value targets requiring additional protective measures.",[134,135,136,137,138,139],"CIS Control 6","CIS Control 8","NIST AC-7","NIST AC-12","NIST SI-4","OWASP ASVS 2.1",{}]