Conversation

Notices

1. Embed this notice
   BrianKrebs (briankrebs@infosec.exchange)'s status on Wednesday, 03-Jun-2026 20:49:56 JST BrianKrebs

   RE: https://infosec.exchange/@briankrebs/116670688015956223

   Dashlane posted an update saying hackers brute-forced its two-factor authentication system, and gained access to the encrypted password vaults for "fewer than 20 personal plan users." Dashlane said there was no evidence of a hack of its own systems, but it hasn't shared yet why or how that 2FA was compromised. The company said “the goal of the attack was to brute-force two-factor authentication (2FA) protections to allow the attacker to register new devices on existing user accounts,” and that it has already notified affected users.

   https://support.dashlane.com/hc/en-us/articles/36038764990866-Security-advisory-Brute-force-attack-on-Dashlane-user-accounts?7194ef805fa2d04b0f7e8c9521f97343

   • Embed this notice
     Rich Felker (dalias@hachyderm.io)'s status on Wednesday, 03-Jun-2026 20:49:55 JST Rich Felker

     in reply to

     @briankrebs "gained access to the encrypted password vaults" sounds like they weren't encrypted.

     Unless they mean the attackers only gained access to what amounts to random bits.

   • Embed this notice
     Rich Felker (dalias@hachyderm.io)'s status on Wednesday, 03-Jun-2026 20:54:08 JST Rich Felker

     in reply to

     @briankrebs Ahhh, that makes sense. So if they have strong passphrases, nothing. But if weak, crackable offline with big resources.

   • Embed this notice
     BrianKrebs (briankrebs@infosec.exchange)'s status on Wednesday, 03-Jun-2026 20:54:09 JST BrianKrebs

     in reply to

     • Rich Felker

     @dalias They got access to 20 encrypted vaults. They'd still have to work out the master password for those targeted accounts. Theoretically, that could be done offline, as happened w/ the breach at LastPass, but it took many months for a lot of those stolen vaults to be cracked.